Ransomware attack on maritime software supplier DNV disconnected 1,000 ships from ShipManager servers

Norwegian maritime software supplier DNV suffered a significant ransomware attack last week that left around 1,000 ships without a connection to on-shore servers.

In a recent announcement, the company said that threat actors infiltrated its ShipManager software on January 7 and encrypted it with malware. ShipManager is DNV’s fleet management software that supports the management of vessels and fleets in all technical, operational, and compliance aspects. Soon after identifying the ransomware attack, the company took its servers offline to contain the spread of the malware.

“All vessels can still use the onboard, offline functionalities of the ShipManager software, other systems onboard the vessels are not impacted. The cyber-attack does not affect the vessels’ ability to operate,” the company said. It added that the ransomware attack did not impact any other DNV servers.

“The Ship Manager IT-infrastructure is isolated from the rest of DNV’s servers and the forensic investigation conducted by DNV’s global IT security partners has confirmed that no lateral movement to other parts of the DNV IT infrastructure was detected as part of the attack.

“Information like DNV user accounts, emails, and all other services have not been affected by the incident,” the company added.

DNV has informed the Norwegian Police about the ransomware attack and reported the incident to the Norwegian National Security Authority, the Norwegian Data Protection Authority (DPA), and the German Cyber Security Authority. All affected customers have also been notified about the security incident and asked to contact their respective Data Protection Authorities in their countries.

As of now, DNV hasn’t shared any details on who was behind the ransomware attack, how the threat actors infiltrated its ShipManager software, or if the company has received any ransom demand.

Christian Borst, EMEA CTO at Vectra, said that the ransomware attack on DNV is the latest in a long line of breaches showing Critical National Infrastructure (CNI) is becoming an increasingly attractive target for cybercriminal groups.

“Offline features are allowing affected ships to operate in a limited capacity while the ShipManager servers are shut down, but this attack should act as a reminder that infiltrating critical systems can give hackers control of physical processes, disrupt vital services, and damage specialised equipment.

“Once ransomware is deployed, the damage has already been done, so organisations involved in fleet management and other CNI sectors must focus on improving their threat detection and response capabilities to spot the signs of an attack as soon as possible. This means reducing the noise they face from security alerts, and achieving clearer attack signal intelligence so security teams can accurately and reliably prioritise threats, and stop attacks before they can cause any disruption.”