Maritime Cyber Threat Brief #1: A Claim Against 38 Maritime Firms, Critical Flaws in Wärtsilä FOS, and Two Port Outages

The incidents, CVEs and threat intelligence that matter to ships, ports and shipping companies, as of 30 October 2026

Captain Paul

Maritime 4.0 · AI, Data & Cyber Security · LinkedIn

This is the first of a weekly brief. The common thread this time: the exposure sits with the vendor and the shore-side system, not on the bridge. One extortion group may have reached dozens of maritime companies through a single software supplier, a fleet-optimisation product shipped with hard-coded keys, and two ports fell back to manual work after IT outages. Because this is the first issue, it also catches up on events from August and September.

At a Glance

Date	Where	What	Status
12 Oct 2026	Global, 18 countries	n0n lists 38 maritime organisations	Unverified claim
26 Oct 2026	Global	Blue Initiative maritime vulnerability database launched	Public resource
15 Sep 2026	Global (vendor: Finland)	Wärtsilä FOS-Onboard: CVE-2026-78225, CVE-2026-81855	Patch available
Sep 2026	Malaysia	Port of Tanjung Pelepas terminal operations halted	Phased restart from 10 Sep
4 Aug 2026	North Carolina, USA	NC Ports IT outage; manual gate processing	Actor not identified

Ⅰ. Incident: n0n Names 38 Maritime Organisations

On 12 October 2026 the extortion group n0n, which only appeared in mid-September, posted a single batch of maritime organisations on its leak site: shipping companies, port terminal operators, logistics firms, ship managers and agents across 18 countries.

Listed	38 organisations in 18 countries (some reports say 37 or 40+)
Demands	Cydome reports USD 400 thousand to USD 400 million per listing, about USD 1.22 billion in total. SOCRadar's review, as reported in the trade press, put them at USD 2.4–14 million. The figures have not been reconciled.
Deadline	19 October 2026. Risky Bulletin reports most victims refused to pay and their data was posted.
Suspected source	Cydome assesses the data is likely linked to one CyberLogitec support and project archive, split into per-customer listings. At least 21 of the 38 are documented CyberLogitec customers. Cydome states this is "not confirmed".
Vendor	According to Cydome, citing Korean press, CyberLogitec confirmed the named Korean companies are its customers, sent them a precautionary notice and reported their systems operating normally. It has not confirmed an incident.

Everything here should be read as alleged. Being named on a leak site does not mean a company's own network was breached, and some of the data is reported to be years old. For that reason this brief does not list the named companies.

Captain Paul's reading

If the single-archive theory holds, this is 38 listings from one breach, and that is the lesson. Support tickets, project files and EDI samples held by a vendor can describe a company's systems in detail, and that company's own security controls never see them. Even if nothing on board was touched, the leaked detail makes very convincing material for phishing the fleet.

Ⅱ. CVE: Hard-Coded Keys in Wärtsilä FOS-Onboard

CISA published advisory ICSA-26-258-02 on 15 September 2026 and updated it on 24 September, after Cydome reported two flaws to Wärtsilä and CISA.

CVEs	CVE-2026-78225 (server key, deployer-ng Update Controller) and CVE-2026-81855 (client authentication key, robot testing framework). Both CWE-321.
Severity (CISA)	CVSS v3.1 8.3 High; CVSS v4 9.0 Critical. Cydome's coverage cites 9.5 and 9.3, so check which score your process uses.
Impact	An attacker could deliver an unauthorised update, execute code, or extract credentials to impersonate a privileged client.
Affected / fixed	FOS-Onboard 5.07.0923.01 → fixed in 5.08.4052.01
Exploitation	None known to CISA at publication. The attack vector is adjacent network, not internet.
Vendor position	Wärtsilä says the flaws "are not exploitable when the product is installed as recommended".

Captain Paul's reading

The vendor's qualifier only helps if you know how your ship was actually installed, so verify it on board. An update channel is an especially sensitive place for a hard-coded key, because it is designed to change what runs on the system. If FOS is on your ships, confirm the version, confirm the network it sits on, and record both.

Ⅲ. Ports: Two Outages, Same Fallback

Port of Tanjung Pelepas, Malaysia. The port confirmed a cybersecurity incident affecting its operating systems that temporarily halted container terminal operations, with a controlled, phased restart from 10 September 2026. The port handled over 14 million TEU in 2025 and is a main hub for the Maersk and Hapag-Lloyd Gemini network. A group called "direwolf" has reportedly claimed the attack on its leak site; no official source confirms that or says it was ransomware.

North Carolina Ports, USA. An attack detected on 4 August 2026 caused a systems-wide IT outage at Wilmington, Morehead City and the Charlotte Inland Port. The authority activated its cybersecurity contingency plan and moved gates to manual processing; normal gate hours returned on 6 August while processing stayed manual. It said the breach was contained with "no indication that sensitive data was compromised". No actor has been identified.

Captain Paul's reading

In both cases what kept cargo moving was a manual procedure, so that is the thing to rehearse. For ship operators, a port outage is also an operational event: expect berthing delays and changed gate procedures, and be wary of "urgent" emails about them, since an outage is an easy pretext for phishing.

Ⅳ. Threat Intelligence: A Public Maritime CVE Database

On 26 October 2026 BankInfoSecurity reported the launch of the Blue Initiative, a public database of vulnerabilities affecting maritime systems, founded by companies including Cydome, Rakuten Maritime, ClassNK and Bureau Veritas, with MTS-ISAC participating. It draws on vendor advisories, the CVE database and CISA's Known Exploited Vulnerabilities catalog, grouped by navigation, propulsion, communications, industrial controls and onboard IT.

The most useful number is the split: of 29,505 vulnerabilities tracked, only 37 are in maritime-only systems. The rest are mostly ordinary fleet IT such as email and web servers.

Captain Paul's reading

Read that way, most of a fleet's vulnerability exposure is ordinary IT, which ordinary patch discipline can reach. For teams maintaining UR E26 CBS inventories, a shared catalogue like this could make vulnerability review far less manual. I will be watching how well it matches real shipboard product versions.

Ⅴ. How This Connects to IACS UR E26/E27

None of this week's main stories is a rule failure. UR E26 and E27 focus on the ship and its computer-based systems, while a vendor's support archive or a port's terminal system sits outside that scope. Two practical links are worth making:

• Inventory: if a product like FOS-Onboard runs on board, it belongs in your asset records with its version, so an advisory can be answered in minutes. Check with your class society how it is treated in your CBS scope.
• Supplier assurance: a type-approved product does not tell you what the supplier keeps about you. Ask what customer data vendors hold, for how long, and how they will notify you of a breach.

Ⅵ. What to Do This Week

1. List vendor support and remote-access accounts; rotate shared or long-lived credentials.
2. If you use CyberLogitec products, review admin and integration accounts first, and account activity from July 2026 onward (Cydome's recommendation).
3. Warn staff and crews about targeted phishing that quotes realistic ticket, EDI or invoice details.
4. Check whether FOS-Onboard 5.07.0923.01 is on your fleet; plan the update to 5.08.4052.01.
5. Add breach-notification terms and MFA requirements to vendor contracts at the next renewal.
6. If your company is named: verify where the data came from before responding to any demand.

Sources

• Cydome: n0n extortion incident likely traces back to a single vendor (15 Oct 2026)
• Risky Bulletin: supply chain attack and shipping companies (23 Oct 2026)
• Financial Ports: 38 maritime firms face $14m ransom deadline (SOCRadar figures)
• CISA ICSA-26-258-02: Wärtsilä FOS-Onboard (Update A)
• Cydome: CISA publishes its first Wärtsilä advisory
• Lloyd's List: Cyber attack disrupts operations at Port of Tanjung Pelepas
• OODAloop brief on Tanjung Pelepas (11 Sep 2026)
• BleepingComputer: North Carolina Ports confirms cyberattack
• WECT: NC Ports operating manually after cyberattack (6 Aug 2026)
• BankInfoSecurity: Maritime sector to catalog nautical software vulnerabilities (26 Oct 2026)

Captain Paul

Maritime 4.0 · AI, Data & Cyber Security

Specialises in OT/IT cyber security and IACS regulatory analysis for the shipping and shipbuilding industries. Publishes a weekly brief on the incidents, CVEs and threat intelligence that matter to ships, ports and shipping companies.

🛡️ More Threat Trends ↗

⚓ Join the ShipPaulJobs Community

Join →