We covered the Carnival Corporation breach in our Intelligence Brief (16–30 April). ShinyHunters listed over 8.7 million records from Holland America Line's Mariner Society loyalty programme. Have I Been Pwned corroborated roughly 7.5 million unique email addresses. The data reportedly includes names, contact details, dates of birth, loyalty numbers, and possibly passport and payment information.

That was two weeks ago. This week the story moved from cybersecurity pages to courtrooms.

Between 22 and 24 April, three separate class-action lawsuits were filed in the United States District Court for the Southern District of Florida. The plaintiffs allege weak cybersecurity controls and delayed notification to affected individuals. One filing specifically claims that two-factor authentication was not in place on the compromised account — the single phishing compromise that Carnival says gave attackers access to the third-party environment containing the loyalty database.

The lawsuits seek financial compensation, lifetime credit monitoring, and a court-ordered overhaul of Carnival's data security. ShinyHunters had given Carnival until 21 April to pay. The lawsuits landed the next day.

This goes well beyond cruise lines. The legal argument in all three filings rests on a simple chain: company held millions of personal records, did not apply a basic control (2FA), got breached through exactly the vector 2FA would have stopped, then delayed telling the people whose data was taken. That chain fits any maritime operator holding PII. Ferry companies, port authorities, crewing agencies, ship managers. If the system with passenger or seafarer data does not have MFA, the Carnival playbook applies.

The insurance angle follows the same logic. Cyber liability policies now routinely require MFA as a baseline condition. A breach where MFA was absent may trigger coverage disputes. The Carnival filings preview how post-breach litigation will be framed going forward: not as a sophisticated nation-state attack nobody could stop, but as a failure to implement a control that has been standard practice for a decade.

Why this matters: Class-action litigation after a maritime cyber breach is new territory. Carnival is the test case. The standard being set is simple: "did you have 2FA?" Every maritime operator handling PII should be able to answer that question today.

One thing to do: Check whether every system in your organisation that holds passenger, seafarer, or crew personal data has multi-factor authentication enabled. Not "planned." Enabled. If your crewing platform, loyalty database, or booking system still relies on username and password alone, the Carnival lawsuits just told you what the litigation will look like.

CISA published eight ICS advisories on 30 April, covering ABB and Mitsubishi Electric products. Two are directly relevant to ports, offshore, and shipyards.

ABB System 800xA and Symphony Plus, IEC 61850 stack (CVE-2025-3756). A validation flaw in the IEC 61850 MMS client stack lets crafted network packets trigger device faults and denial of service in AC800M CI868 controllers (800xA), Symphony Plus SD CI850, and Symphony Plus MR PM877 modules. Repeated exploitation forces manual restarts and breaks IEC-61850-based power and control communications. These ABB platforms run substation automation and power distribution, including shore power systems, terminal substations, and industrial plants next to port operations.

Mitsubishi MELSEC iQ-F EtherNet/IP modules (CVE-2026-1874, CVE-2026-1875, CVE-2026-1876). Resource shutdown and control flow bugs in FX5-ENET/IP and FX5-EIP modules. Continuous UDP traffic from an unauthenticated source causes denial of service requiring a physical module reset. NVD scores CVE-2026-1874 at CVSS 7.5 (v3.1) and 8.7 (v4.0). MELSEC iQ-F controllers show up in shipyard production lines, cargo-handling equipment, and embedded vessel control systems.

Both are remotely triggerable. Neither requires credentials. Both require network reachability, which, as the Forescout BRIDGE:BREAK research showed two weeks ago (Issue #8), is the default state for far too many OT devices in maritime networks.

Why this matters: If you run ABB 800xA or Mitsubishi MELSEC in your port, terminal, or shipyard, these are not theoretical advisories. They are your Tuesday patch meeting.

One thing to do: Check whether your OT asset inventory covers ABB System 800xA/Symphony Plus modules and Mitsubishi MELSEC iQ-F Ethernet modules. If yes, verify that IEC 61850 and EtherNet/IP traffic is segmented from corporate IT and from internet-facing networks. If your inventory does not include power distribution and substation automation, it is incomplete.

Two things happened in late April that are worth noting together.

Marlink added Stellar Cyber NDR (28 April). Marlink, one of the largest maritime connectivity and managed security providers, plugged Stellar Cyber's behaviour-based Network Detection and Response into its security operations stack. The result: unified visibility across IT, OT, and endpoint traffic for Marlink's managed service customers, covering both vessel and shore-side networks. Until recently, that kind of detection capability meant building your own SOC. Now it comes bundled with your connectivity contract.

MPA Singapore + Hamburg Port Authority MoU (20 April). Singapore's Maritime and Port Authority signed a cybersecurity cooperation agreement with Hamburg Port Authority and four universities (SIT, SUTD, University of Hamburg, Hamburg University of Technology). The scope runs from port cybersecurity systems to unmanned vessels, remote ship operations, shipboard OT, and joint exercises. Two of the world's top-10 ports committing to shared cyber exercises is worth paying attention to.

Good signs, both of them. But the distance between "MoU signed" and "joint incident response during a live attack" is measured in years. And managed NDR reaches the operators who already have a security programme, not the small and mid-size companies that our research keeps showing are most exposed.

Why this matters: Maritime cyber defence infrastructure is being built. The concern is that it matures on a five-year timeline while the threat moves on a five-day one.

All editions at newsletter.maritime-ogmios.tech.

Full conference calendar: mc3.maritime-ogmios.tech