The Marshall Islands Maritime Administrator has warned that hostile cyber actors are targeting commercial ships. The warning is Ship Security Advisory (SSA) No. 08-26. It was published on 30 October 2026. Attackers use internet-facing network gear on board as a way into ship information technology (IT) and operational technology (OT) systems.
IT means office computers, email and shipboard servers. OT means systems that support navigation, cargo and machinery. The advisory says the most likely entry points are firewalls, routers and virtual private network (VPN) devices at the satellite communications boundary.
What prompted the warning
The US Coast Guard (USCG) and the Federal Bureau of Investigation (FBI) confirmed two suspected cyber attacks. Both involved vessels bound for the United States in August 2026. One ship was boarded in the Gulf of Mexico on 21 August 2026. A second ship was boarded on 24 August 2026. The agencies said one vessel lost communications for more than 30 hours near the Strait of Gibraltar. They reported no physical danger to the crew and no pollution.
The Marshall Islands also notes that some companies get alerts from national police or computer security teams through the charterer. Those alerts may name the ship and a firewall's public internet address. They may arrive before any port State contact.
What IMCA learned from a tanker cyber incident
On 5 November 2026, the International Marine Contractors Association (IMCA) published Safety Flash SF 19/26. It describes a cyber incident on an oil tanker on a voyage from Egypt to Galveston, Texas. Attackers deleted data on several work PCs linked to the ship's server. Email and vessel management programs stopped working. The US Coast Guard and the FBI later boarded the ship.
IMCA says the damage looked like a "wiper" attack. That means the aim was to destroy systems, not to demand money. No problems were found in key OT systems. The damage was limited to the business IT network. Still, the flash says a business-IT cyber incident can create serious operational and safety risks.
What crews should watch for
SSA 08-26 tells shipboard personnel to report these signs at once to the Company Security Officer (CSO):
Unexplained loss or poor quality of satellite communications.
Unexpected reboot, configuration change or administrator logon on network equipment.
ECDIS, GNSS, AIS or radar behaviour that does not match independent position fixing.
Any outside contact that claims the ship or company has been compromised.
What to do if you suspect a cyber attack
The Marshall Islands asks companies and crews to preserve evidence. Do not reimage, reset, reconfigure, upgrade firmware, restore from backup, or power down an affected system until the scope is clear. Export logs and the device configuration first. Antivirus scans on PCs do not check a network appliance, and they can destroy useful evidence.
IMCA adds similar lessons. Isolate infected PCs and servers carefully. Keep enough firewall and server logs for an investigation. Do not rely only on the telecom provider's firewall. Keep crew welfare internet separate from navigation, cargo and machinery networks.
What it means for crews
Tell the master and the CSO at once if satcom, email or bridge electronics behave in a strange way.
Do not reset a firewall, router or satcom terminal yourself unless the company orders it after evidence is saved.
Do not click unknown email links or open strange attachments on shipboard PCs.
Keep personal phones and crew wifi off any path to bridge or engine systems.
ETOs and electricians: see ETO salaries on Crewboard if your company needs cyber-skilled watchkeepers.
Masters looking for a new contract can check Master vacancies on Crewboard.
Keep official help contacts from Crewboard useful links.
Cover photo: Satellite antennas on the cruise ship Ruby Princess. Illustrative photo for shipboard communications equipment. Photo: Eric Polk/Wikimedia Commons, CC BY-SA 4.0.
Sources: Republic of the Marshall Islands Ship Security Advisory No. 08-26: Maritime cyber security — targeting of shipboard network infrastructure (30 Oct 2026), Marshall Islands active Ship Security Advisory index (lists SSA 08-26, published 30 Oct 2026), IMCA Safety Flash SF 19/26: Cyber-attack on vessel (published 5 Nov 2026).
How we choose, write and correct our articles: editorial policy.
