Marshall Islands warns of targeted cyberattacks on shipboard networks

According to the advisory, the US Coast Guard (USCG) and Federal Bureau of Investigation (FBI) confirmed that two vessels bound for the United States were subjected to suspected cyberattacks during August 2026.

The first vessel was boarded in the Gulf of Mexico on August 21 by USCG law enforcement, inspection and cyber protection personnel, alongside an FBI cyber team, following indications that its network had been compromised by foreign cyber actors. A second vessel was boarded on August 24.

The first vessel was reportedly in the Strait of Gibraltar when the compromise occurred and experienced a communications outage lasting more than 30 hours. However, authorities reported no resulting operational disruption, vessel instability, physical danger to crew or environmental impact.

The advisory also describes separate notifications from foreign law enforcement and cybersecurity authorities identifying compromised vessels and specific network devices. In one case, authorities identified an onboard firewall by its public internet protocol address and requested preservation of its logs.

No state or group has claimed responsibility, and no government has publicly attributed the incidents to a particular actor.

Shipboard network infrastructure identified as potential entry point

The Administrator assesses that commercial vessels may be deliberately targeted rather than simply affected by opportunistic malware infections.

Particular concern surrounds internet-facing equipment at the satellite communications boundary, including firewalls, routers and VPN concentrators. These systems are frequently managed remotely by third parties, may operate with outdated firmware and are not necessarily protected by antivirus software installed on shipboard computers.

The advisory specifically references the exploitation of Fortinet FortiGate devices and the FortiBleed credential-compromise campaign, which has exposed administrator credentials for internet-facing firewalls and VPN gateways.

Importantly, the Administrator warns that upgrading affected firmware alone is insufficient, as previously compromised credentials may remain valid.

The warning comes amid growing attention to the security of onboard equipment. A September 2026 analysis by CYTUR found that 94% of the marine equipment assessments examined warranted consideration of, or required, cyber risk treatment. The company emphasized that actual risk depends not only on known vulnerabilities but also on network exposure, connectivity and the potential operational consequences of a compromise. The findings were based on a limited, nonrepresentative sample.

A successful intrusion into shipboard networks could allow attackers to access voyage, cargo and crew information, interfere with shore communications or potentially reach navigation and cargo systems where IT and OT networks are insufficiently segregated.

The advisory also highlights potential exposure through connections with port and terminal systems, particularly where third parties are granted access to shipboard networks.

The emphasis on identifying and addressing vulnerabilities also aligns with the recently launched Blue Initiative maritime cybersecurity database. Announced on October 26, 2026, by Cydome, ClassNK, Bureau Veritas, MTS-ISAC and Rakuten Maritime, the initiative aims to help shipping companies identify relevant IT and OT vulnerabilities and prioritize security updates across their fleets.

The Administrator further emphasizes that the absence of unusual behavior onboard should not be considered evidence that a vessel has not been compromised, as detection may occur long after an intrusion and originate from external authorities.

Preserving evidence after a suspected cyberattack

A central recommendation concerns the response to suspected cyber compromises. The Administrator advises companies to notify their Company Security Officer, the company, the flag administration and, where relevant, the port State without delay.

Crucially, affected systems should not be reset, reconfigured, updated, restored or powered down before the scope of the compromise is understood, as such actions could destroy important digital evidence.

Companies should immediately preserve network logs, configurations, account information and remote access records, alongside relevant Voyage Data Recorder data.

The advisory also cautions that conventional antivirus scans do not examine evidence stored on network appliances and may alter or remove artifacts required for forensic investigations.

Cybersecurity and port State control

The advisory notes that the USCG’s cybersecurity regulations, effective July 16, 2025, apply to US-flagged vessels and regulated facilities, but do not directly apply to Marshall Islands-flagged vessels.

Nevertheless, the USCG has indicated that scrutiny of cybersecurity risk management on foreign-flagged vessels will increase through port State control examinations under the International Safety Management (ISM) and International Ship and Port Facility Security (ISPS) Codes.

This follows the USCG’s October 2026 cybersecurity implementation guidance, which clarifies requirements for regulated US vessels, facilities and offshore installations ahead of the July 2027 compliance deadline. The guidance places particular emphasis on IT and OT risk assessments, remote access, third-party dependencies, incident response and evidence of effective cybersecurity controls.

The Administrator reminds companies that all maritime cyber incidents involving Marshall Islands-flagged vessels must be reported using the prescribed incident reporting procedure. This obligation also applies when external authorities identify a suspected compromise, even before an investigation has been completed.