IMO Cyber-Attack Has Serious Implications

For the past day and a half, visitors to the official International Maritime Organization website,, have been greeted with the message “This website is under maintenance.” But the maintenance is not routine, it’s the result of a cyber-attack and comes at a time when the IMO is under intense scrutiny, is working to bring attention to the global crew crisis, and is asking member nations to enforce “IMO 2021“, a resolution requiring ship owners to invest in cybersecurity measures.

The attack also comes just days after Shipping Giant CMA CGM was hit by a ransomware cyberattack.

“What could have motivated these attacks?” asks Dr Will Perez, Director of Cybersecurity Solutions at Moran Cyber.  “Was it a random occurrence or a targeted message to the international maritime industry?”

On Friday, the IMO tweeted a new statement admitting it was hacked. “The interruption of service was caused by a cyberattack against our IT systems,” says the tweet. “IMO is working with United Nations IT and security experts to restore systems as soon as possible, identify the source of the attack, and further enhance security systems to prevent a recurrence.”

An IMO spokesperson then told Reuters that internal and external emails continued to work normally and that the organization was working to restore access to public documents.

Could The Attack Be Related To Wakashio?

We don’t know and there is currently no hard evidence connecting this attack to recent criticism of the IMO‘s response to the MV/ Wakaship bunker spill.

We don’t know that the source of the attack but we do know it happened just weeks after over 100,000 protesters took to the streets in Mauritius to protest the mishandling of  MV Wakashio salvage and oil recovery efforts.

While the IMO has released a statement claiming their involvement in the spill was limited, the fact remains that they are the lead UN agency in Mauritius and, in numerous videos, the IMO expert they sent to represent the organization claimed responsibilities and provided damaging advice beyond the scope of the IMO’s charter and in the wake of these massive protests, rather than correcting his errors, the organization issued a new statement saying they “fully back” his work. (NB: we can’t link to the statement due to the website errors).

The situation in Mauritius has deteriorated to such an extent that the Pope himself has called for more help.

Journalists too have cried numerous times for help (literally cried in the case of this author). “When the Pope has to intervene in your industry, you know you’re in trouble.” wrote Forbes contributor and BBC veteran Nishan Degnarain. “How many more signals does the IMO need to see to believe that global shipping is an industry in meltdown?” he continued in a follow-up article this week.

“It is unacceptable for a poor third-world government only to receive tens of millions of dollars in compensation for a clean-up that will cost hundreds of millions of dollars to undertake,” argued David Osler of Lloyds List. “Even if that is legally right, it is morally wrong.”

“The IMO has fossilized; it needs something to wake it up.” said Andrew Craig-Bennett in Splash24/7 last week. “A change of scenery (To Singapore) might do that.”

This is not the first attack (nor the last)

The 2017 Not Petya malware attack grabbed global headlines caused massive disruption and required Maersk to rebuild its network of 4,000 servers and 45,000 PCs costing the company hundreds of millions of dollars and the total cost to the world economy was much higher.

In 2017 Hackers stole classified Navy warship blueprints from DSME’s shipyard in Korea.

In 2018, COSCO Shipping Lines was hit by a cyber-attack affecting terminal operations, while the ports of Barcelona and San Diego were targeted in separate ransomware attacks

This week the French shipping giant CMA CGM said that its back-offices are gradually being reconnected to the network, after a major attack the costs of which are still unknown

And these are just the major headlines. Thousands more small or unsuccessful attacks happen against the maritime industry computers, systems, and people every day.