Lessons learned: Cybersecurity requires more than a single firewall

During the voyage, a cyberattack affected multiple workstations connected to the vessel’s onboard server, deleting operating systems and stored information.

Although the initial point of entry has not been confirmed, the preliminary investigation identified several weaknesses in the vessel’s communications and cybersecurity arrangements.

The vessel relied heavily on its telecommunications provider’s firewall, without additional security devices directly managed by the company.

Disconnecting affected systems can help prevent further damage, but responding without preserving forensic evidence may make it more difficult to determine how the attacker gained access.

IMCA emphasized that preventing similar incidents requires several complementary security measures rather than reliance on a single protective system.