Segregate connectivity networks to mitigate cyber risk

Passenger ships face a uniquely broad cyber risk profile because they combine transport, hospitality and consumer data environments.

Cybersecurity concerns for ferries and cruise ships include the hacking of critical navigation and propulsion systems, ransomware attacks disabling operations and onboard services, and the theft of passengers’ personal data.

The increasing connectivity of passenger vessels, along with vulnerabilities in terms of onboard wifi, increase the risk of cyber attacks on guests and crew, while dependency on vulnerable satellite communications raises risks for operational security and safety.

“The most immediate exposure comes from passenger and crew connectivity,” said Marlink president for maritime, Tore Morten Olsen,

“Thousands of personal devices create a large and constantly changing attack surface, which is why strict separation between guest networks and operational or business systems is essential,” he explained.

Disruption to the onboard accommodation environment is another major risk for ferries and cruise ships operating worldwide.

“Systems supporting retail, catering, excursions and passenger services are directly tied to revenue and experience and can be targets for phishing and credential-based attacks,” said Mr Olsen. “Any compromise in these systems is immediately visible and reputationally damaging.”

Cyber incidents affecting navigation or machinery systems can become safety events, which is why IMO guidance requires cyber risks to be managed within the ship’s safety framework.

The potential consequences of a security breach could include loss of propulsion, corrupted positioning data or failure of critical onboard systems.

“The shipping industry increasingly recognises that cyber risk must be treated alongside traditional maritime safety risks, not as a separate IT concern,” said Mr Olsen.

IMO sets out the main regulatory requirements for passenger ships, including maritime cyber frameworks, through its maritime safety and facilitation committees.

“Any compromise in these systems is immediately visible and reputationally damaging”

The International Association of Classification Societies (IACS) set unified requirements E26 and E27 for cyber-resilient ships and onboard bridge systems.

There are national frameworks, including US Coast Guard rules, which raise expectations around cyber resilience across IT and operational technology and the European Union’s NIS2 directive, which introduces stricter requirements for data protection, risk management and incident reporting, with penalties for non-compliance.

“The challenge for passenger ship operators is cumulative and global,” said Mr Olsen. “They must align maritime safety regulations, class requirements and data protection laws while operating across multiple jurisdictions in a continuously evolving compliance environment.”