The thread: this week confirmation arrived by post, by statute and by satellite, and each time it answered a narrower question than the one people were asking.

On 16 June, in issue #15, our lead was a leak-site listing. The Qilin ransomware group had named the Shipping Association of New York and New Jersey, the employers' association of the Port of New York and New Jersey, and we called it a claim until the association confirmed it. On 2 October the association confirmed an incident, in the way most confirmations arrive: a breach notice to a US state regulator.

The notice, filed by the association's lawyers with the New Hampshire Attorney General, says that "on May 27, 2026, an unauthorized actor accessed certain systems within the computer network, and took files." The association finished reviewing the files on 9 July and mailed letters to the people affected on 2 October. The template letter tells them that the systems "hosted information relating to certain benefits plans that you participate in", and that the files could contain their "name, date of birth, Social Security number, driver's license number and/or medical treatment/diagnosis information." The New Hampshire filing covers three residents of that state. We have not found a total.

The letter does not mention Qilin or ransomware. The dates fit, with the intrusion on 27 May and the listing on 8 June, but the association has not said the two are the same event, and we will not say it for them.

Look at what the confirmation answers. In June the coverage, ours included, was about cargo: an association that coordinates a whole port, and the friction an attack on it could cause. The letter is about people. The files it describes hold personal and medical information about members of benefits plans, and nothing in the notice mentions operations.

Why this matters for maritime: between the listing and the letters, 116 days passed, and the only public record of the incident was the attacker's. That is normal. A breach notice is written for the people whose data was taken, not for the companies that work with the victim. If you are a member, a supplier or a customer, you may never receive one.

Two new maritime listings this week, both still claims, are in Scuttlebutt below.

What to do: List the organisations that hold data about your people, not only about your systems: associations, benefits and pension plan administrators, crewing and payroll providers, training centres. Ask each of them how they would tell you about a breach, and how quickly. Then decide who in your company watches for their names. Leak-site trackers show the claim. In the US, state attorney general breach pages often show the confirmation, months later.

Test your response: A ransomware group lists the association that handles hiring and benefits for your port's workforce. The association says nothing. By the end of the week your dock workers are asking whether their Social Security numbers are out. What do you tell them on day one, and what on day thirty? Port of San Diego: When Ransomware Meets the Harbor →

On 6 October the Maritime and Port Authority of Singapore (Amendment) Bill was read for the first time in Parliament. According to MPA, it "will establish a sectoral cybersecurity framework under the MPA Act, enabling MPA to designate Important Information Infrastructure (III), set cybersecurity requirements, and issue directions to safeguard these systems and infrastructure." The second reading is scheduled for November.

The bill goes further than the press release. A "maritime entity" includes anyone providing an essential transport service in Singapore, the owner of a Singapore ship, and the owner of "any other vessel" in or intending to enter Singapore's territorial waters. Operational technology is named: a computer system includes "an industrial control system, a programmable logic controller, a supervisory control and data acquisition system, or a distributed control system". The new rules apply to systems located in or outside Singapore, and, in the words of the explanatory statement, notices and directions "may be given to individuals and entities regardless of their location or nationality."

Once MPA designates a system, its operator must report prescribed incidents "within the prescribed period", a deadline that will be set later in regulations. The operator must also commission an audit at least every five years, run a risk assessment every year, and follow MPA's directions and standards. Failing to report is an offence, with a fine of up to S$20 000, six months in prison, or both.

The section we read twice is 89T. MPA "may conduct cybersecurity exercises for the purpose of testing the state of readiness" of an operator, and the operator "must participate in a cybersecurity exercise conducted in respect of any designated III if directed in writing to do so". Refusing without reasonable excuse can cost up to S$20 000. We run exercises for a living, so weigh this paragraph accordingly.

The US is working on the same question from the reporting end. CISA's final rule under CIRCIA, which will require reports of major cyber incidents within 72 hours and of ransom payments within 24, reached the White House Office of Information and Regulatory Affairs for final review on 1 October. Seatrade reports that port authorities, waterfront employers and Matson want one report to the Coast Guard to satisfy both agencies. It also quotes the Port of Virginia's comments to CISA: "There have been several cases of cyber incidents within the maritime industry which the port has discovered through news reports rather than through our federal partners."

Why this matters for maritime: most cyber regulation asks for reports after the event. Singapore's bill also lets the regulator decide when an operator practises, and makes taking part compulsory. Nothing can be designated until the bill passes, and designation is MPA's decision system by system, but the definition of a maritime entity reaches foreign owners whose ships call at Singapore.

What to do: If your ships or terminals depend on Singapore, read the explanatory statement at the end of the bill, which walks through the new Part in plain English, and mark which of your systems could meet the designation test: needed for an essential transport service, and its loss would substantially affect that service or the port. Then write down the incident you would report, to whom and how fast, in your three busiest jurisdictions. If the three answers differ, that difference is your next exercise.

Test your response: Your regulator designates the terminal operating system as critical and directs you to run a cyber exercise in six weeks. Your incident reporting procedure was written for a different regulator in a different country. Who leads the exercise, and what do you find out about your own procedure? NIS2 Nightmare: The Audit That Turned Into a Crisis →

Last week we covered a Georgia Tech study that found GPS spoofing patterns in AIS data, and its own warning that AIS "cannot localize transmitters". Since then, Lloyd's List Intelligence has launched Satellite Confirmed Spoofing on its Seasearcher platform. When the platform flags a possible spoofing event, "suitable satellite imagery can be automatically checked against the vessel's AIS-reported position and timestamp. If no vessel is visible within the defined search area, the event can be elevated from Probable AIS Spoofing to Confirmed AIS Spoofing."

The company says it uses optical and radar (SAR) imagery, computer vision models and checks for cloud cover and image suitability. Its Chief Research Officer, Arne Staal, put the point plainly: "detection models are by nature probabilistic", and satellite corroboration "marks a shift from inference to independent evidence". The material gives no accuracy or miss rates. Its only number is "an observed 20x increase in events detected between 2022 and 2024", without a method.

Look at what is being confirmed. The image shows empty sea where the ship said she was. That proves the broadcast position was false. It does not show where the ship was, or why the position was false. LLI writes for compliance teams, insurers and regulators, and its context is sanctions evasion, where the question is whether a ship is lying about where she is. But a ship whose GNSS receiver is spoofed by someone else's transmitter also broadcasts a position where she is not. From orbit, deception and interference can look the same.

Why this matters for maritime: a "confirmed spoofing" event attached to one of your ships may now sit in a charterer's, insurer's or bank's file before it reaches you. If the cause was interference, the evidence that says so is on your bridge, and only if somebody wrote it down.

What to do: Check that when your ships meet GNSS interference, the bridge records it: the time, the position by radar or visual fix, what the GNSS showed, and when it recovered. Keep those entries with the voyage records, and keep the VDR data from interference areas for longer than the minimum. If anyone shows you a satellite image of empty sea, that log is what separates interference from deception.

Test your response: Your charterer's compliance team sends a satellite image: empty sea where your tanker's AIS placed her last Tuesday, and a request for an explanation within 48 hours. The master says the GNSS was "jumping" that day, and the deck log has no entry. What can you show them? Ghost Ships of the Black Sea: When GPS Lies →

Full calendar, with cyber tracks flagged: https://mc3.maritime-ogmios.tech

Unconfirmed signals from open-source and regional channels we monitor. Confidence is flagged on each item. Treat these as early warning, not fact, until confirmed.

Now confirmed, graduated: the Shipping Association of New York and New Jersey, listed by Qilin on 8 June. The association's breach notice is Story 1 above, 116 days after the listing.

Sociedad Portuaria Mardique (single source: the attackers' listing), listed by Nightspire on 8 October. The description field is empty. The domain on the listing, spmardique[.]com, belongs to a private multipurpose port in Cartagena, Colombia, which lists mobile cranes, container handling, bulk silos and hydrocarbon storage on its website. The tracker estimates the attack at 3 July, three months before the listing.

Delta Marine (single source: the attackers' listing), listed by Qilin on 6 October. The domain, deltamarine[.]com, belongs to the Seattle builder of custom yachts, but the listing carries a Finnish flag, so even the identification is uncertain.

Everything else about both is the attackers' claim: no statement from either company, and nothing about what was allegedly taken.

Maritime and Port Authority of Singapore (Amendment) Bill, Bill No. 24/2026 (Singapore Statutes Online, published 6 October 2026)

The explanatory statement at the end walks through the new cybersecurity Part section by section, in plain English: who counts as a maritime entity, how designation works, what operators must report, audit and practise. If you have ships or terminals in Singapore, it is the fastest way to see what November's debate is about.

Bill No. 24/2026 on Singapore Statutes Online →

Maritime Cyber Intelligence Brief covers what the weekly cannot: full incident timelines, regulatory analysis, GNSS threat data, and OT advisory breakdowns. The latest issue is a free preview.

Read the Intelligence Brief →

"Ransom War: How Cyber Crime Became a Threat to National Security", by Max Smeets, 2025.

Smeets traces how ransomware moved from ordinary crime to a national security problem, through cases including the state of emergency Costa Rica declared after the 2022 Conti attack.

Relevant this week because reporting rules like CIRCIA and Singapore's bill are what that shift looks like when it reaches a port.

Browse maritime cyber book recommendations →