More than 250 maritime companies have been identified as affected by the FortiBleed credential leak, according to maritime cyber security specialist Cydome, with shipowners and ship management companies making up the largest share of exposed organisations.
The incident involved the leak of more than 86,000 administrator credentials for Fortinet firewalls and related network devices across 194 countries. Cydome’s threat intelligence team also identified 703 satellite-linked IP addresses associated with maritime satcom service providers in the leaked dataset.
According to the company, 41.5% of leaked maritime-related logins belonged to shipping and freight companies, followed by offshore contractors and service companies at 31.2%. Newbuild and repair yards accounted for 10.7%, while port authorities and logistics companies represented 6.7%.
Cydome said the incident differs from many cyber attacks because it relies on administrator credentials that remained valid after organisations upgraded their software. In many cases, passwords linked to older systems were never fully replaced, leaving attackers able to test exposed credentials against live devices.
“Consistent with FortiBleed hitting the operational core of maritime trade, not just back-office IT,” said Nir Ayalon, Founder and Chief Executive Officer of Cydome.
The company also found that 87% of internet-exposed Fortinet devices still had internet-facing management interfaces available, while 63% of harvested credentials were linked to default or built-in administrator accounts that had never been renamed.
“This suggests that many organisations have not yet taken the steps needed to fully secure affected systems… probably because they don’t know they have been hacked, yet!” Ayalon said.
Cydome said appearing in the leaked dataset does not confirm that an organisation has been compromised, though it indicates that credentials linked to network security infrastructure have been exposed.
“If attackers obtain trusted administrator access, they can move through networks unnoticed, gain control over operational systems or sell the information to ransomware groups and other cybercriminals. Protecting digital identities is just as important as protecting the IT and OT systems themselves,” said Alon Ayalon, Co-founder and Vice President of Research and Development at Cydome.
