ShipPaulJobs Weekly Cyber Brief, November Week 1, 2026: A Terminal Down at Le Havre, n0n's Exposed Server, and a US Deadline for Cyber Plans

The incidents, CVEs and threat intelligence that matter to ships, ports and shipping companies, as of 2 November 2026

Captain Paul

Maritime 4.0 · AI, Data & Cyber Security · LinkedIn

This week's brief has one new event and two useful updates. The common thread: the hard questions are about recovery and basic access, not exotic attacks. A container terminal in Le Havre stopped handling boxes for reasons nobody has publicly established, new research suggests the n0n group got in with weak or stolen passwords, and US-regulated operators now have a dated requirement to put their cyber plans on paper.

At a Glance

Date	Where	What	Status
13–14 Oct 2026	Le Havre, France	Terminaux de Normandie suspends container handling after an IT disruption	Cause not established
14 Oct 2026	France	M-CERT warns the maritime sector of DDoS attacks	Reported; no major outage confirmed
30 Oct 2026	Global	Update: SOCRadar finds n0n's exposed server	Researcher findings
20 Oct 2026	USA	USCG NVIC 02-26: Cybersecurity Plans due 16 July 2027	Published guidance
29 Sep 2026	Global	Georgia Tech study of GPS spoofing across 367,000+ vessels	Research, reported by press

Ⅰ. Incident: A Container Terminal Stops at Le Havre

On the evening of 13 October 2026, according to local press, systems at Terminaux de Normandie, the Le Havre container operation that Kuehne+Nagel refers to as the TNMSC terminal, began failing. One logistics firm dates the incident to 14 October. Management is reported to have confirmed a disruption to its information systems that caused a temporary suspension of handling operations.

Impact	Receiving and delivering goods stopped, and data exchange with partners was not working normally. Storage and monitoring of refrigerated containers continued, as reported on 16 October.
Cause	Not established. HAROPA Port did not confirm the origin. Kuehne+Nagel calls it a "cyber attack", and dockworkers are reported to suspect one, but no ransomware, claim of responsibility or data leak has been tied to the terminal in the sources reviewed here.
Status	Kuehne+Nagel's update for 14–20 October said the terminal "remains closed", with no container gate-in or gate-out and no confirmed restart timeline. Its 21–27 October update says only that TNMSC suspended operations during Storm Austen and does not mention the cyber event. We could not confirm a reopening date as of 2 November.
Workaround	Empty containers could still be collected and returned through private depots, and significant congestion was expected once operations resume.

Captain Paul's reading

Whatever the cause turns out to be, the operational picture is the same. When a terminal system stops, gate and transhipment work stop with it. The detail I would keep is that reefer monitoring reportedly continued, which shows someone had thought about what must keep running. Ship operators calling at any single-terminal port should ask what their booking and cargo plan looks like if that terminal is dark for days. And please don't repeat "cyberattack" as fact yet: nobody with the evidence has said so publicly.

Ⅱ. France: DDoS Warning, Limited Confirmed Effect

On 14 October the French maritime cyber incident response centre, M-CERT, warned the sector of ongoing or imminent DDoS attacks, reportedly attributing the campaign to the pro-Russian collective NoName057(16). Stratégies Logistique lists French ports and maritime companies as targets about 48 hours after the Le Havre failure, and states that no major interruption is publicly confirmed for any of them other than Le Havre. No public source links the DDoS campaign to the terminal outage. We have not read the M-CERT alert itself, and because the listed organisations have not confirmed an impact, this brief does not name them.

Captain Paul's reading

The timing invites a neat story, and that is exactly why to be careful with it. DDoS usually hurts websites and availability for a while, which is a very different event from a terminal losing its operating systems for days. Treat them as two separate things until someone shows they are connected.

Ⅲ. Update: What n0n's Exposed Server Shows

The October Week 4 brief covered n0n listing 38 maritime organisations on 12 October. On 30 October The Register reported that SOCRadar had found the operator's own server left open, with 1,719 files including attack scripts and ransomware source code.

Access	SOCRadar's CISO is quoted: "In every documented compromise in this investigation, access relied on weak or stolen credentials." Methods included RDP scanning, FortiGate SSL-VPN credential stuffing, an exposed AWS key and reused hosting portal sessions. It found no evidence of vulnerability exploitation in the cases examined.
Scale	The group has claimed 108 victims since appearing in September. The server shows attempts against 23 organisations in 14 countries.
Maritime listings	The report says none of the 38 were marked settled, no payment addresses showed transactions, and all the data was published. It links at least 21 to customers of the maritime software provider CyberLogitec, which has not confirmed an intrusion.
Demands	Now reported as USD 400 thousand to USD 28 million. The October Week 4 brief carried two other ranges (USD 400 thousand–400 million from Cydome and USD 2.4–14 million from SOCRadar via trade press). The figures remain unreconciled.
AI use	More than USD 7,216 on AI services by 22 October, using an open-source coding agent. Attribution is not settled: the group is believed to be Russia-based, but the server gave no definitive evidence.

Captain Paul's reading

Note the limit: these findings describe the cases on that server, and they do not tell us how the maritime data was obtained. The single-vendor theory remains unconfirmed. Still, the practical lesson is plain. Spending on AI did not make this actor sophisticated, and strong authentication on VPN and remote access would have made most of the routes it documents much harder. That work costs far less than a new security product.

Ⅳ. Rules: USCG Puts a Date on Cybersecurity Plans

The US Coast Guard released NVIC 02-26, implementation guidance for its 2025 cyber rule (33 CFR Part 101, Subpart F), republished by Maritime Executive on 20 October. It applies to owners and operators of US-flagged vessels, facilities and Outer Continental Shelf facilities regulated under MTSA.

Deadline	Cybersecurity Officer designations, Cybersecurity Assessments and Cybersecurity Plans completed and submitted by 16 July 2027.
Enclosures	Plan development, a sample officer designation letter, penetration testing guidance, and an optional NIST CSF-based scoping method.
Worth noting	Penetration testing is not required in the initial plan submission. There is no requirement to hire a third party for the assessment or plan. The requirements are performance-based.

Captain Paul's reading

Eight months sounds comfortable, but inventory and network documentation take longer than expected on a working fleet. Those records overlap with UR E26 work, so owners with ships under both regimes should try to build them once. I read this from the Coast Guard text as republished, so check the circular itself before relying on the details.

Ⅴ. Threat Intelligence: Measuring GPS Spoofing at Scale

A Georgia Tech study published on 29 September, reported by Hackread, examined AIS data from more than 367,000 vessels between late November 2024 and early February 2025. It found 17,936 abnormal episodes involving 2,663 vessels and 31 persistent zones: 13 corroborated as spoofing, 9 newly identified, and 9 suggestive only.

One finding links to a case this blog has covered. Near Port Sudan in January 2025, about five months before the MSC Antonia grounding, the researchers found vessels showing the same type of displacement, with false tracks reportedly matching the later MSC Antonia pattern in latitude to the fifth decimal place.

Captain Paul's reading

The authors call their numbers a lower bound, since short or single-ship events fall outside the method, and AIS cannot identify who is transmitting. What matters on the bridge is the Port Sudan detail: a repeating pattern was visible in data months before a ship went aground. Spoofed positions in your own AIS and VDR history are worth reviewing, not just discarding as noise.

Ⅵ. CVEs: Nothing Maritime-Specific This Week

The newest advisories on CISA's ICS list, dated 27–29 October, cover EPICS Base, Mitsubishi Electric and ICONICS, Siemens Mendix and Hitachi Energy products. Judging by product names, none is marine-specific, though we only reviewed the first page of the list. If any of these appear in your shore or port systems, handle them through normal patching.

Ⅶ. How This Connects to IACS UR E26/E27

None of this week's main stories is a UR E26 or E27 failure. A terminal system, a credential attack on shore IT and a US regulation all sit outside those rules. Two practical links are still worth making:

• Reuse of evidence: asset inventories and network diagrams built for UR E26 can feed other cyber plans. Confirm with your class society and, for US-flagged assets, against the NVIC itself.
• Remote access: the n0n findings are a reminder to check how remote access to ship systems is authenticated in practice, and not only what the approved documents describe.

Ⅷ. What to Do This Week

1. If you have cargo or calls through Le Havre, confirm terminal status directly with your agent or carrier.
2. Write down what you would do if your main terminal were offline for a week: alternative ports, cargo data held offline, reefer priorities.
3. Require MFA on VPN and RDP access, and check for exposed cloud keys and reused portal sessions.
4. Disable or restrict internet-facing RDP and review FortiGate SSL-VPN login logs for credential stuffing.
5. US-regulated operators: read NVIC 02-26, name your Cybersecurity Officer and plan backwards from 16 July 2027.
6. Ask bridge teams to report and log position jumps, and keep the records.

Sources

• Kuehne+Nagel: Port operational updates, 14–20 Oct 2026
• Kuehne+Nagel: Port operational updates, 21–27 Oct 2026
• cyberattaque.org: Le Havre, Terminaux de Normandie (16 Oct 2026)
• Stratégies Logistique: Cybersécurité, les ports français dans la tourmente (16 Oct 2026)
• Kohen Avocats: Terminal à conteneurs à l'arrêt au Havre (25 Oct 2026)
• Port Continuity Brief (30 Oct 2026)
• The Register: Crim spent $7K+ on AI services in extortion attacks (30 Oct 2026)
• Maritime Executive: US Coast Guard releases new maritime cybersecurity compliance guidance (20 Oct 2026)
• Hackread: 367,000-ship study finds global GPS spoofing (2 Oct 2026)
• CISA: ICS advisories

Captain Paul

Maritime 4.0 · AI, Data & Cyber Security

Specialises in OT/IT cyber security and IACS regulatory analysis for the shipping and shipbuilding industries. Publishes a weekly brief on the incidents, CVEs and threat intelligence that matter to ships, ports and shipping companies.

🛡️ More Threat Trends ↗

⚓ Join the ShipPaulJobs Community

Join →