Intel Brief

Maritime Cyber Intelligence Brief

1–15 October 2026 · Free preview. The full issue — 23 developments across six sections — ships to subscribers by email.

Two stories in brief

Full analysis, recommended actions, tabletop scenarios, and cited sources in the complete issue.

INCIDENT · CRITICAL

Thirty-eight shipping and port names in twenty-three minutes

Between 13:53 and 14:16 UTC on 12 October, the extortion group n0n added 38 organisations to its leak site: container terminals in Brazil, Spain, Morocco, Turkey, India, Vietnam, Saudi Arabia and Korea, shipping lines including Ocean Network Express, port IT and EDI providers, agents, depots and a surveyor. Twelve of the entries are in South Korea. Every entry but one carries the same countdown: files to be published on 19 October at 13:27 UTC.

What the group says it holds is narrow and repetitive: EDI message archives (stowage plans, gate movements, bookings), terminal operating system configuration and release documentation, invoices and disbursement accounts. The demand figure in the headlines, “up to USD 14 million”, is the highest of the six listings one researcher reviewed. One analysis of all 38 puts the demands between USD 400000 and USD 400 million each.

Two caveats hold everything else in place. None of the 38 entries carries a domain field, so even the identity of each victim rests on a name the attacker typed. And no listed organisation has confirmed an incident. The only on-record responses so far are Korean, and they say the companies are checking.

Why it matters: the list reads like a sector, not like a set of victims chosen one at a time. If your organisation exchanges EDI with any terminal, line or agent on it, your booking references, container numbers and consignee details may sit in somebody else’s archive whatever your own security. The full issue sets out the supplier hypothesis now circulating and the evidence behind it, what the one vendor named has said, the three steps worth taking before the deadline, and the question every critical software supplier should be asked this month.

REGULATION · MEDIUM

The UK’s GNSS guidance puts most of the loss ashore

On 1 October the UK Maritime and Coastguard Agency published MGN 719, “Operating in GNSS denied and degraded environments”. It is guidance, not a requirement, and it is addressed to shipowners, masters and officers of the watch, but also to harbour authorities, port operators and VTS providers.

The navigation advice is familiar. Two details are not. The note treats timing as a dependency in its own right, listing “Data and monitoring networks using NTP or PTP synchronisation” and “Control and monitoring systems dependent upon UTC traceability”. And it quotes the government’s estimate of losses from a seven-day GNSS outage: £183 million for shipping, £1309 million for port operations and £8 million for fishing.

On the government’s own numbers, ports carry about 87 per cent of the maritime loss.

Why it matters: most GNSS resilience work in shipping is done on the bridge. These figures point to the port systems that timestamp, sequence and reconcile container moves and berth schedules, often through a single time server nobody has examined since installation. A clock that drifts is harder to notice than a clock that stops. The full issue sets out what the note asks of terminals, paragraph by paragraph, and the one tracing exercise worth doing this quarter.

The full brief also covers

Subscribers only — the complete analysis ships by email.

Section 1 · Incidents & Attacks
🔒 The supplier hypothesis behind the 38 listings: what the evidence is, what the one vendor named has said, and what it would mean for the material you have sent your own software suppliers over the years 🔒 A cyber incident at the contractor building the Fehmarn Belt tunnel, what the owner confirmed, and what only a local newspaper reported 🔒 The propulsion claim about a US-bound tanker, the engine-room photographs that travelled with it, and what the record actually says 🔒 The lead story of our first paid issue, confirmed 116 days after the listing — and why the confirmation is about something else 🔒 Five companies that supply ships, listed on leak sites in one fortnight 🔒 Three letters on a leak site, and a language model’s guess at which connectivity company they mean 🔒 A Colombian port, a cruise line’s booking data, and the names that have not spoken for seven weeks
Section 2 · Regulations & Standards
🔒 Singapore’s port bill in full: how it sits beside the Cybersecurity Act, the clause that reaches systems connected to the regulator’s, a 30-day change-notification duty, and compulsory exercises 🔒 A cyber baseline for ships contracted before July 2024, and a correction of our own 🔒 The IMO’s third quiet period, and a European conference we can no longer vouch for
Section 3 · Threats — OT/ICS and GNSS/PNT
🔒 Twenty-two ICS advisories, none sold as maritime equipment, and one product documented on a classed vessel 🔒 A third advisory in three weeks for an embedded network stack no asset register lists, and a flaw in a government monitoring tool 🔒 Sixteen exploited vulnerabilities in a fortnight, two of them in email gateways 🔒 Old vulnerabilities back on the exploited list, from an advisory that never mentions ships — and why that matters to the EDI end of the industry 🔒 The spoofing study our last issue missed, now headed for a top security conference 🔒 “Confirmed spoofing” by satellite, and what an empty patch of sea does and does not prove 🔒 Three weeks of interference figures from the Red Sea and the Gulf, and the ratio that tells you more than either number
Section 4 · Ports & Supply Chain
🔒 Why US ports want one incident report, the mechanism that exists for it on paper, and the reporting duty that already applies 🔒 The connectivity provider becoming the security provider, and the question to ask before signing
Section 5 · People, Training & Governance
🔒 A naval and university exercise that put a ship nobody could control across a port entrance 🔒 What the fortnight’s commentary added, and two numbers that came without a source

Every locked item carries the same depth as the two above: the pattern behind it, the scale of the exposure, the board-level read, the recommended actions, and where one fits, a tabletop you can run with your team. Every claim cited, every unverified claim labelled as one — including three corrections of our own.

Upcoming maritime cyber events — free

Public events on the forward horizon. No subscription required.

Subscribe

Past issues stay free to read in full. From the June 2026 issue, the complete brief is subscriber-only — each new issue still gets a short free summary.

Monthly
€49/mo
 
  • Full semi-monthly reports
  • Cancel anytime
Subscribe
Semi-Annual
€249/6 mo
€41.50/mo · Save 15%
  • Full semi-monthly reports
Subscribe
Best Value
Annual
€399/yr
€33.25/mo · Save 32%
  • Full semi-monthly reports
Subscribe
Founding
Founding Member
€299/yr
€100/yr below Annual · locked forever
  • Same content as Annual
  • Limited to 25 members
  • First founders already on board
  • 22/25 spots remaining
Become a Founding Member

Also available in GBP, USD, PLN — select your currency at checkout.