Hurtigruten suffers cyber attack

Hurtigruten IT executive Ole-Marius Moe-Helgesen said the cruise line’s “global IT infrastructure appears to be affected” by this security breach.

Once Hurtigruten discovered the attack on its servers, it informed relevant authorities and sent a statement to the Oslo Stock Exchange. In that statement, Hurtigruten said “we do not expect a material financial effect from the cyber attack.”

However, visitors to the company’s websites are faced with this message: “Sorry, the website is not working right now" and are directed to use Instagram and Youtube to view information about its ships and destinations.

This ransomware attack is the latest to impact shipping companies, with rival cruise ship owner Carnival Corp also attacked earlier this year. Container shipping groups such as CMA CGM and MSC, plus IMO’s headquarters have also been hit by cyber attacks this year.

Ports are also vulnerable to cyber attacks and are improving their defences, as highlighted in December when Port of Los Angeles contracted IBM to design and operate a cyber resilience centre.

The attack on Hurtigruten comes as Norwegian organisations are collaborating to form a cyber resilience centre to assist shipowners and managers in improving their defences. Norwegian Shipowners’ Association will co-operate with Norwegian Shipowners’ Mutual War Risks Insurance Association (DNK) to form the Norwegian Maritime Cyber Resilience Centre (Norma Cyber).

Amid these successful attacks, ABB Marine & Ports has opened a cyber security laboratory to help shipowners and operators combat the maritime industry’s growing cyber security risks. This laboratory will offer cyber security support for shipping companies at all stages of digitalisation, said ABB.

It has the flexibility to meet cyber security requirements, from the one-off assessment of existing IT and operational technology to long-term continuous support. ABB’s cyber security laboratory can monitor network traffic and act on vulnerabilities, collect and manage security logs for the control system components and alert crew and managers of cyber events, enforce security policies to zones and conduits, and provide reference information for network segmentation and segregation.

“Cyber security is not a product but an evolving target which needs constant monitoring, managing and updating,” said ABB Marine & Ports head of cyber security Ahmed Hassan. “As a single vendor offering operating technology and cyber security, we recognise that managing cyber security is a careful balance between risk, functionality and cost,” he said.

“The principles of cyber security must apply across all maritime stakeholders, from designers and builders, to owners, operators and crew; and from classification societies to universities and research bodies, government departments and insurers.”