INDUSTRY FACT FILE · MARITIME, PORTS & SHIPPING

Five New Case Studies in Port and Shipping Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in ports, terminals, shipping companies and shipyards and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Terminal That Lost Its Yard 3.  Case Study 2: The Crane That Took Remote Commands 4.  Case Study 3: The Container Released to the Wrong Truck 5.  Case Study 4: The Ship That Sailed on a Spoofed Position 6.  Case Study 5: The Shipyard Design Files on a Foreign Server

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in maritime and port operations with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, NCIIPC's critical-sector expectations, IMO and IACS requirements for ships, the ISPS Code, SEBI disclosure for listed groups and DPDP.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Terminal That Lost Its Yard	Container terminal operator	Ransomware on TOS, gates and backups	CERT-In; concession; SEBI LODR	B3, B7, B10
2. The Crane That Took Remote Commands	Bulk and container port	OEM remote access reaching crane PLCs	ISPS; CERT-In; safety	B9, B1, B7
3. The Container Released to the Wrong Truck	Port community and terminal portals	Cargo release fraud through stolen credentials	Customs; CERT-In; DPDP	B2, B7, B9
4. The Ship That Sailed on a Spoofed Position	Bulk shipping company	GNSS spoofing and navigation compromise	IMO MSC.428(98); DGS; class	B5, B1, B10
5. The Shipyard Design Files on a Foreign Server	Shipyard	State-backed theft through a subcontractor	Contracts; export controls; CERT-In	B3, B9, B7

Every crane worked. Nobody knew where a single box was.

At a glance
Organisation	A listed group's container terminal (“Termco A”) handling two million TEU a year
Threat	Ransomware encrypting the terminal operating system, gate servers and the backup server after weeks of undetected lateral movement
Why it is new	Cargo systems, not cranes, decide whether a terminal runs
Codec Networks services	Segmentation and recovery, SOC, crisis exercises (Bundles B3, B7, B10)

The scenario

Attackers phished a yard planner and, over three weeks, took domain control unnoticed. On a Friday night they encrypted the TOS, gate servers and the backup server, all on the same network.

Cranes and RTGs were intact, but without the TOS nobody knew where containers were. Gates closed, trucks queued for kilometres and two vessels diverted to a neighbouring port.

Rebuilding from a vendor image took nine days. Customers invoked service credits, customs asked questions and the group disclosed the incident in its quarterly report.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• TOS, gate and backup servers shared one network and one set of credentials.
• No immutable or offline backup of the TOS.
• EDR alerts were not monitored 24x7.
• No manual yard and gate playbook.

The impact

Termco A lost nine days of operations, paid service credits, faced customs and customer scrutiny and disclosed the incident quarterly.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• Concession agreement: performance and continuity obligations to the port authority.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	Segmentation of TOS, gate and OT networks; immutable backups; tested restores	B3
Detect early	24x7 SOC with EDR monitoring and threat hunting	B7
Rehearse the outage	Manual yard and gate playbooks and crisis exercises with customers and customs	B10

Key lessons Treat the TOS as the terminal's heart. Keep backups off the domain and test restores. Monitor endpoints around the clock. Plan to run the yard on paper.

The spreader fault came from a laptop three time zones away.

At a glance
Organisation	A port (“Portco B”) operating quay cranes under an OEM maintenance contract
Threat	A crane OEM's shared diagnostic account compromised by credential stuffing and used to alter PLC parameters over a permanent remote link
Why it is new	OEM links are the most common unmonitored path into terminal OT
Codec Networks services	Vendor access programme, OT assessment, OT monitoring (Bundles B9, B1, B7)

The scenario

Portco B's crane OEM kept a permanent remote link for diagnostics, using an account shared by several engineers and reused on other sites.

The account was compromised in a credential-stuffing attack. The intruder reached the crane control network and changed PLC parameters, causing spreader faults and an emergency stop on three berths.

A near-miss investigation found no session recording, no MFA and a control network reachable directly from the OEM link.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Permanent OEM link with a shared, reused password and no MFA.
• Crane control network reachable from the vendor connection.
• No monitoring of parameter or logic changes.
• No record of remote sessions.

The impact

Portco B lost two days on three berths, conducted a safety investigation, reported the incident and renegotiated OEM support with security requirements.

The regulatory lens

• ISPS Code: port facility security plan review after the incident.
• CERT-In Directions: incident reported within six hours.
• Safety obligations: near-miss investigation under port and labour safety rules.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control vendors	Brokered, time-bound access with MFA and recording; OEM assessment	B9
Protect the cranes	OT assessment and isolation of crane and PLC networks behind a terminal DMZ	B1
Watch the OT	Monitoring of OEM sessions and parameter changes	B7

Key lessons Replace permanent OEM links with brokered access. Isolate crane and PLC networks. Monitor parameter and logic changes. Record every vendor session.

The paperwork was perfect. The truck was not.

At a glance
Organisation	A terminal (“Gateco C”) releasing containers through PCS and its own portal
Threat	A forwarder's portal credentials phished and used to alter delivery orders and nominate the criminals' own trucks for high-value containers
Why it is new	Release fraud exploits trust between terminals, forwarders and platforms
Codec Networks services	Portal and API testing, fraud analytics, partner access programme (Bundles B2, B7, B9)

The scenario

Criminals phished a freight forwarder's staff and obtained their portal credentials, which had no MFA.

They altered delivery orders for electronics containers and nominated their own trucks. Gate automation released the boxes on valid-looking documents.

The theft surfaced when the real consignee's trucks arrived. Customs, police and insurers opened inquiries and Gateco C hardened the portal under pressure.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No MFA for forwarder and agent accounts.
• No anomaly detection on delivery-order and nomination changes.
• No release verification for high-value cargo.
• Partner access never reviewed.

The impact

Gateco C faced cargo theft claims, customs and police inquiries, customer distrust and an emergency portal programme.

The regulatory lens

• Customs Act and documentation rules: release and manifest integrity.
• CERT-In Directions: incident reported within six hours.
• DPDP: consignee and driver data accessed through the portal.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the portal	Portal and API security testing, MFA for all trade users	B2
Watch the releases	Fraud analytics on delivery orders, nominations and gate events	B7
Govern partners	Forwarder and agent access reviews and awareness	B9

Key lessons Enforce MFA for every trade user. Monitor delivery-order and nomination changes. Verify high-value releases. Review partner access regularly.

The chart said deep water. The keel said otherwise.

At a glance
Organisation	A bulk shipping company (“Shipco D”) operating twelve Indian-flag vessels
Threat	Spoofed GNSS signals near a congested anchorage drifting the ECDIS position towards shallow water, followed by a night grounding
Why it is new	Navigation inputs can be manipulated without touching the ship
Codec Networks services	Ship cyber programme, bridge system review, drills (Bundles B5, B1, B10)

The scenario

Approaching a congested anchorage at night, one of Shipco D's bulk carriers received spoofed GNSS signals. The ECDIS position drifted steadily and AIS broadcast the wrong location.

The bridge team followed the display without cross-checking radar and visual fixes, and the vessel grounded on a shoal.

The fleet review found no spoofing detection, no procedure for degraded navigation and a safety management system that mentioned cyber only in passing.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No GNSS integrity monitoring or cross-check routine.
• No degraded-navigation procedure or drill.
• SMS cyber content generic and untested.
• Advisories on interference not reaching the bridge.

The impact

Shipco D faced salvage and repair costs, cargo delays, a flag-state investigation and a fleet-wide cyber and navigation programme.

The regulatory lens

• IMO MSC.428(98) and ISM Code: cyber risk in the safety management system examined at audit.
• DG Shipping: flag-state investigation and circular compliance.
• Class and insurers: survey findings and claims scrutiny.

How Codec Networks would help

Need	Codec Networks response	Bundle
Build the programme	MSC.428(98) assessments, SMS procedures and UR E26/E27 readiness	B5
Review the bridge	ECDIS, GNSS, AIS and satcom reviews	B1
Drill the crews	Degraded-navigation and cyber drills for bridge teams	B10

Key lessons Cross-check every position. Drill for navigation without GNSS. Make the SMS cyber content real. Route interference advisories to the bridge.

The competitor's hull lines matched to the millimetre.

At a glance
Organisation	A shipyard (“Yardco E”) building commercial and naval vessels
Threat	A design subcontractor's VPN credentials stolen by a state-backed group and used to copy hull and system designs from the yard's PLM system over months
Why it is new	Subcontractor access is the softest path to a shipyard's most valuable data
Codec Networks services	Data classification and access control, supplier programme, threat hunting (Bundles B3, B9, B7)

The scenario

Yardco E engaged a design subcontractor with VPN access to its PLM system. The subcontractor's credentials were stolen by a state-backed group.

Over several months the group copied hull, propulsion and system designs for commercial and naval projects, blending in with the subcontractor's normal activity.

The theft surfaced when a foreign competitor bid with a near-identical design. Customer audits, contract penalties and a security rebuild followed.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Design data unclassified and broadly accessible through the VPN.
• Subcontractor access not brokered, MFA-protected or monitored.
• No DLP or export monitoring on PLM data.
• No threat hunting for persistent intrusions.

The impact

Yardco E lost competitive advantage, faced customer penalties and export-control scrutiny and rebuilt its data governance and supplier controls.

The regulatory lens

• Customer and defence contracts: confidentiality and security obligations.
• Export controls: handling of controlled technical data.
• CERT-In Directions: incident reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Protect the designs	Data classification, PLM access control, DLP and brokered access	B3
Govern subcontractors	Supplier security programme with assessments and audit rights	B9
Hunt the intruder	Threat hunting and monitoring of PLM and VPN activity	B7

Key lessons Classify and restrict design data. Broker and monitor subcontractor access. Watch for bulk exports. Hunt for persistent intrusions.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com