What actually targets small maritime operators.
Most maritime cyber coverage focuses on container shipping and superyachts. The threat picture for inshore fishing operators, quayside businesses, and harbour-dependent SMEs in a place like Whitby is different — and in some ways more exposed, because the defences are usually lower.
Business Email Compromise
Attackers impersonate a known supplier or harbour authority by email, substitute bank details on an invoice, and intercept a payment. Small maritime businesses — fish merchants, chandlers, marine engineers — are a regular target. The money is usually gone within 24 hours.
Ransomware
Malicious software encrypts every file on a computer and demands payment to restore access. Delivery businesses, quayside operations, and any business running accounts or booking systems on a single PC with no offsite backup are particularly at risk. Insurers are increasingly excluding coverage.
Phishing
Fraudulent emails or text messages that mimic HMRC, the MCA, Amazon, or a bank, designed to capture credentials or install malware. Volume is enormous. One click by any crew member, office staff, or family member can compromise an entire operation.
GPS / AIS Spoofing
Deliberate transmission of false GPS coordinates or AIS vessel positions. Russian electronic warfare activity in the Baltic has produced documented anomalies. The North Sea is not immune. For fishing vessels, this affects position logging, gear marking, and track records used in quota compliance.
Social Engineering
Phone calls from individuals impersonating HMRC, bank fraud teams, or technical support. Tight-knit maritime communities are particularly vulnerable — an attacker who mentions the right harbour name or local business establishes credibility fast. Urgency and authority are the levers.
Supply Chain Attacks
Compromising a trusted software supplier or third-party service to gain access to their customers. Chart plotter firmware updates, vessel management software, and fleet tracking platforms all represent supply chain exposure that individual operators cannot directly control.
The attack surface on a modern fishing vessel.
Even a modest inshore vessel now carries more networked electronics than most small offices did a decade ago. Chart plotters, AIS transponders, and satellite communicators all have software — and software has vulnerabilities.
Garmin GPSMAP, Raymarine Axiom, Furuno GP series and similar multifunction displays run embedded operating systems, increasingly with Wi-Fi, NMEA 2000 network connectivity, and over-the-air update capability. Key steps: enable automatic firmware updates where available; disable Wi-Fi when not actively in use; never connect unknown USB devices; do not share the onboard network password with transient crew or visitors.
Class B AIS (the standard for vessels under 300GT) broadcasts vessel name, MMSI, position, speed, and course without encryption. This data is publicly aggregated on sites like MarineTraffic. Be aware that your movement patterns are fully visible. Some fishing operators deliberately use their AIS visibility to establish documented presence in disputed or quota-relevant waters — this is a legitimate tactical use, but it means your track history is a permanent, public record that can be examined by regulators, insurers, and competitors alike. Spoofed AIS broadcasts — false vessel positions — cannot be authenticated by a receiver. If your AIS position appears unreliable or other vessels' positions behave anomalously, cross-reference against a second source.
Civilian GPS carries no authentication. A spoofing signal — which broadcasts false GPS data at higher power — can cause a receiver to report an incorrect position without any visible error indication. If something feels wrong (position disagrees with visual reference, radar, or expected transit time), trust your other senses and non-GPS navigation. Keep a paper chart.
VHF radio itself carries minimal cyber risk, but the MMSI number linked to your DSC controller is publicly registered and identifies your vessel. Ensure your MMSI is correctly registered with Ofcom (apply or update at ofcom.org.uk/manage-your-licence/radiocommunication-licences/ships-radio) and your radio licence is current. False distress calls via DSC are a separate concern — if you receive an anomalous DSC alert with an unrecognised MMSI, treat it with appropriate caution and report to the Coastguard.
Iridium GO, Inmarsat BGAN, Garmin inReach and similar devices connect to global satellite networks. The communication is encrypted in transit. Key risks are account-level: a compromised account could be used to rack up significant data charges or redirect emergency messaging. Use strong, unique passwords for all satellite comms accounts. Enable two-factor authentication where supported.
Many vessels now carry a router or mobile hotspot providing Wi-Fi to crew. Never connect navigation equipment to the same network as crew personal devices if avoidable. If separation isn't possible, use the strongest available encryption (WPA3 or WPA2-AES), change the default password, and change the password when crew changes.
If you use a Fishing Vessel Position app or digital catch recording system (MMO/IFCA requirements), ensure the device used is kept updated, password protected, and is not shared with crew for personal use. A corrupted or falsified electronic log — even through accidental malware — can create serious regulatory complications.
A key principle for vessel systems: navigation-critical electronics should be treated as isolated from anything connected to the internet. Where that separation is impossible in practice, the connection should be deliberate, minimal, and understood by the skipper.
For harbour businesses, chandlers, fish merchants, and marine engineers.
Shore-based maritime businesses face the same cyber threats as any other small business — with some additional sector-specific risks. The combination of irregular working hours, physical demands, and a culture of trusting known contacts makes the maritime SME sector a productive target for fraud.
Email is the primary attack vector for invoice fraud, phishing, and credential theft. Enable two-factor authentication on every email account — this single step prevents the majority of account takeovers. Use a separate email address for supplier payments. Be extremely cautious of any email requesting a change to bank payment details.
An attacker gains access to a supplier's or your own email account, monitors ongoing transactions, and intercepts or substitutes a legitimate invoice with altered bank details. Call your supplier directly (from a number you already hold, not one in the email) to verify any payment destination before making a first payment or after any supposed change of account details.
Use a dedicated device for online banking where possible. Never access online banking from public Wi-Fi in the harbourside cafes, pub, or chandler. Enable all fraud alerts your bank offers. Since 7 October 2024, the Payment Systems Regulator (PSR) requires banks to reimburse victims of Authorised Push Payment (APP) fraud up to £85,000 per claim, within five business days. This is mandatory — not discretionary. You must report within 13 months of the payment. Your bank may only refuse if you acted with gross negligence or committed fraud yourself. This is a significant protection that most small maritime operators are unaware of. If your bank resists, cite the PSR mandatory reimbursement requirement and escalate to the Financial Ombudsman Service.
Use a password manager (Bitwarden is free and open source; 1Password is well regarded for small business). Never reuse passwords. A password compromised in one data breach will be tested against banking and email by automated tools within hours.
The only complete defence against ransomware is a good backup. Follow the 3-2-1 rule: three copies of data, on two different media types, one copy held offsite or in cloud storage. Test your backups. An untested backup is a guess.
Networked CCTV cameras are among the most commonly compromised devices in small businesses — typically because default passwords are never changed. Change the admin password on every camera, NVR, and door access controller you own. If it connects to the internet, treat it as a potential entry point.
The biggest risk isn't the technology. It's the habits around it.
In every maritime cyber incident I'm aware of at this scale, the entry point was human behaviour — not a sophisticated technical exploit. Understanding the patterns makes them easier to spot.
WhatsApp groups carrying operational data. Catch returns, quota position, crew plans, and harbour schedules shared on WhatsApp are transmitted via Meta's servers and stored on every participant's device. This is a significant exposure if any device is lost, stolen, or compromised.
Shared credentials for vessel and business systems. A Wi-Fi password that hasn't changed in three years, shared with every crew member past and present, is not a password — it's public knowledge.
Personal devices on vessel networks and business systems. Crew members using personal phones on the vessel Wi-Fi bring every app, website, and potentially every piece of malware from their personal browsing onto the same network as your navigation equipment.
Public Wi-Fi for business use. The harbour café, the pub on the quay, the chandler's waiting room — all provide convenient Wi-Fi routinely used for checking emails, doing online banking, or logging into accounts. A mobile data connection is always preferable for anything sensitive.
Urgency exploited by social engineering. A phone call claiming your bank account is being defrauded creates panic. Panic bypasses normal caution. Any legitimate organisation will give you time to verify their identity independently.
USB drives and unknown media. Found USB drives, drives brought aboard by crew, and unverified software installers from unofficial sources can all introduce malware. A policy of "nothing gets plugged in that we didn't buy" eliminates an entire category of risk.
If something goes wrong — what to do in the first 24 hours.
Speed matters. The quicker you respond to a cyber incident, the greater your chances of limiting the damage, preserving evidence, and recovering funds if fraud is involved.
Isolate the affected system
Disconnect the compromised device from the internet and from any other network immediately. Do not switch it off unless instructed by a professional. Running systems preserve evidence that powered-off systems destroy.
Call your bank immediately if money is involved
If you have made a payment to a fraudulent account, call your bank's fraud line directly. UK banks operate a Payment Services Regulator-mandated APP fraud reimbursement scheme since October 2024. Time is critical.
Report to Action Fraud
Action Fraud is the UK's national reporting centre. Report online at actionfraud.police.uk or call 0300 123 2040. You will receive a crime reference number needed for insurance claims and bank reimbursement requests.
Contact the NCSC if your systems are compromised
The National Cyber Security Centre provides free guidance. Report online at report.ncsc.gov.uk. Their guidance for small businesses and sole traders is practical and free.
Notify the ICO if personal data is involved
You may have a legal obligation to notify the Information Commissioner's Office within 72 hours under UK GDPR, Article 33. Report at ico.org.uk/report-a-breach. Failure to notify when required carries a civil monetary penalty.
Preserve evidence before doing anything else
Take photographs of any ransom messages, fraudulent emails, or unusual screen content before closing windows. Note the time and date. Do not delete emails — they are evidence.
Do not pay ransomware demands without specialist advice
Payment does not guarantee decryption. It funds further attacks. Before paying anything, contact the NCSC and if you have cyber insurance, your insurer's incident response line.
actionfraud.police.uk
ico.org.uk/report-a-breach
999 (emergency)
What the law actually requires — and where the gaps are.
Regulatory obligations in maritime cyber security are a patchwork. Some apply to Whitby operators; many do not. Understanding both is equally important.
The IMO's maritime cyber risk management guidelines require vessels subject to the ISM Code to address cyber risk. The ISM Code applies to vessels of 500GT and over. The Whitby inshore fishing fleet is largely below this threshold and therefore not covered — which means cyber practice is entirely self-motivated.
The MCA follows IMO guidance and has issued its own advice on cyber security for UK-flagged vessels. While no formal cyber obligation exists for inshore fishing vessels, MCA survey teams are increasingly aware of cyber risk. MCA's Marine Guidance Note MGN 728 covers cyber security for ships.
This applies to you if you hold crew employment records, customer data, CCTV footage, or any personal information. The UK GDPR and DPA 2018 require appropriate security measures, breach notification within 72 hours, and demonstrable compliance. The ICO takes enforcement action against small businesses.
The UK NIS Regulations 2018 apply to operators of essential services and relevant digital service providers. Port operators and certain harbour authorities may fall within scope. Individual fishing vessel operators and small quayside businesses typically do not.
This is where most operators are most exposed. Standard P&I cover and hull policies have low cyber sub-limits or exclude cyber loss entirely under war-risk clauses. Ransomware affecting an onboard system, a spoofed invoice paying away operating funds, or a data breach affecting crew records may all be entirely uninsured. Review your cover specifically for cyber. A typical exclusion clause reads something like: “This policy does not cover any loss, damage, liability or expense directly or indirectly caused by, contributed to by, resulting from, or arising out of the use or operation of any computer, computer system, computer software programme, malicious code, computer virus, or any other electronic system.” That single paragraph, buried in policy wording, can void your entire claim. Standalone cyber insurance for small maritime businesses is available from Lloyd’s market insurers. Ask your broker specifically — in writing — whether your current policy covers cyber loss, and keep the response on file.
If your business sends marketing emails or runs a website with tracking, the Privacy and Electronic Communications Regulations apply alongside UK GDPR. Less directly related to cyber security, but part of the same compliance landscape.
The insurance gap is the most underappreciated risk. Before assuming your current marine policy covers a cyber incident, read the cyber exclusions section of your policy wording. If there isn't one, it likely means cyber is not covered, not that it is. Ask your broker in writing.
A practical starting checklist.
If you do nothing else, work through these. They address the most likely causes of a real incident for operators of your scale.
Vessel Systems
Shore Business
None of this requires specialist software, enterprise budget, or technical expertise. It requires awareness and habits. The operators who have been hit have usually known about the risks — they just hadn't yet got round to addressing them.
Who wrote it and why to trust it.
This guide was written by Stuart Thomas — based in Whitby, with 40 years in cryptography, information security, and data protection. No maritime background. Considerable cyber credentials. No commercial relationship with any product, vendor, or insurer mentioned here.
The guide reflects the threat picture as understood in April 2026. It will be updated as the landscape changes. If something here is wrong or outdated, I want to know — email is below.
If you want independent, practical help rather than a guide: stuart-thomas.com/maritime-security.html
Get in touch.
Questions about anything in this guide are welcome. If you're a Whitby vessel operator, harbour business, or maritime training provider and something here has raised a concern — get in touch. Initial questions cost nothing, and I'll tell you honestly if the answer is simply to do what the checklist says.
All communication by email. I respond to every genuine enquiry.
stuartpaulthomas@gmail.com View Services