Cyber attacks on the databases of shipping companies often aim to extract data
illegally that can be utilised to steal cargo by directing its delivery to criminals rather
than to the rightful owners. This has recently been observed in MSC Mediterranean
Shipping Co SA v. Glencore International AG
6 where the Mediterranean Shipping
Co SA (MSC) carried three cargo containers from Fremantle to Antwerp under a bill
of lading. The bill named Glencore International AG (Glencore) as the shipper, and
C Steinweg NV (Steinweg), Glencore’s agents, as a “notify party”. A few days
before the vessel’s arrival at the discharge port, Steinweg lodged with MSC one of
the bills of lading and soon after, MSC emailed to Steinweg a release note and pin
codes for the electronic cargo release system that MSC operated at that port. After
the vessel arrived at Antwerp, and the containers were discharged and stored at
MSC’s terminal, Steinweg sought delivery of the cargo but it transpired that two of
the containers had already been collected by unknown, unauthorised recipients. It
transpired that the unauthorised recipients managed to obtain the pin codes sent to
Steinweg and collect the cargo before the legitimate owner of the cargo under the bill
did so. It should be stressed that other businesses in the maritime supply chain (e.g.,
warehouses), face similar risks; and cargo theft from storage units by falsifying
records in the system or redirecting delivery to unauthorised people are regular
occurrences. In similar fashion, it has been reported on numerous occasions that
the systems of cruise ship operators that hold large amounts of personal data with
regard to passengers (i.e., details concerning bank accounts, credit cards and health
issues) are often the target of cyber criminals.
In recent months, several shipping corporations faced ransomware attacks, which
primarily aim to extort money from the victims. Ransomware uses encryption to lock
up data on infected computers, then demands payment for its return. It is not only
shipping corporations that have fallen victims of this type of cyber crime. In the latter
part of 2018, the ports of Barcelona and San Diego suffered ransomware attacks.
These attacks led to delays in delivery of cargos and restrictions on public access to
some port facilities. It is not clear at this stage whether these attacks were led by
opportunist hackers or criminal syndicates.
It has been suggested that up to 15% of cyber attacks are carried out by
competitors, who aim to obtain a commercial advantage by falsifying data and
records of rival shipping companies or directing their cargo to wrong places,
increasing their costs and liabilities.
7
6 [2015] EWHC 1989 (Comm); aff’d [2017] EWCA Civ 365.
7 Cooper (2019), p. 106.
Cyber Risks Insurance in the Maritime Sector: Growing Pains and Legal Problems
629
illegally that can be utilised to steal cargo by directing its delivery to criminals rather
than to the rightful owners. This has recently been observed in MSC Mediterranean
Shipping Co SA v. Glencore International AG
6 where the Mediterranean Shipping
Co SA (MSC) carried three cargo containers from Fremantle to Antwerp under a bill
of lading. The bill named Glencore International AG (Glencore) as the shipper, and
C Steinweg NV (Steinweg), Glencore’s agents, as a “notify party”. A few days
before the vessel’s arrival at the discharge port, Steinweg lodged with MSC one of
the bills of lading and soon after, MSC emailed to Steinweg a release note and pin
codes for the electronic cargo release system that MSC operated at that port. After
the vessel arrived at Antwerp, and the containers were discharged and stored at
MSC’s terminal, Steinweg sought delivery of the cargo but it transpired that two of
the containers had already been collected by unknown, unauthorised recipients. It
transpired that the unauthorised recipients managed to obtain the pin codes sent to
Steinweg and collect the cargo before the legitimate owner of the cargo under the bill
did so. It should be stressed that other businesses in the maritime supply chain (e.g.,
warehouses), face similar risks; and cargo theft from storage units by falsifying
records in the system or redirecting delivery to unauthorised people are regular
occurrences. In similar fashion, it has been reported on numerous occasions that
the systems of cruise ship operators that hold large amounts of personal data with
regard to passengers (i.e., details concerning bank accounts, credit cards and health
issues) are often the target of cyber criminals.
In recent months, several shipping corporations faced ransomware attacks, which
primarily aim to extort money from the victims. Ransomware uses encryption to lock
up data on infected computers, then demands payment for its return. It is not only
shipping corporations that have fallen victims of this type of cyber crime. In the latter
part of 2018, the ports of Barcelona and San Diego suffered ransomware attacks.
These attacks led to delays in delivery of cargos and restrictions on public access to
some port facilities. It is not clear at this stage whether these attacks were led by
opportunist hackers or criminal syndicates.
It has been suggested that up to 15% of cyber attacks are carried out by
competitors, who aim to obtain a commercial advantage by falsifying data and
records of rival shipping companies or directing their cargo to wrong places,
increasing their costs and liabilities.
7
6 [2015] EWHC 1989 (Comm); aff’d [2017] EWCA Civ 365.
7 Cooper (2019), p. 106.
Cyber Risks Insurance in the Maritime Sector: Growing Pains and Legal Problems
629