MSC Mediterranean Shipping Company Vendor Cyber Rating & Cyber Score

Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack.

Total Financial Loss: The total financial loss from these incidents is estimated to be $550 million.

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes, and law enforcement notified with yes (french and italian authorities), and containment measures with removal of raspberry pi devices, forensic analysis, and remediation measures with network segregation, enhanced monitoring, and recovery measures with ferry resumed operations after investigation, and communication strategy with limited public disclosure (spokesperson confirmed intrusion attempt), and network segmentation with pre-existing segregation prevented lateral movement..

Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Physical access via Raspberry Pi devices.

Average Financial Loss: The average financial loss per incident is $183.33 million.

Incident Response Plan: The company's incident response plan is described as Yes.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Network segregation, enhanced monitoring.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by removal of raspberry pi devices and forensic analysis.

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Ferry resumed operations after investigation.

Key Lessons Learned: The key lessons learned from past incidents are Importance of physical security for onboard networks, network segmentation, and monitoring for unauthorized devices.The industry needs to close security gaps amid an increasingly connected, yet vulnerable, digital landscape. Outdated infrastructure and lack of modern defenses are major vulnerabilities.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Integrate risk management into safety systems, adopt anti-jam technology and and enhance cybersecurity awareness and defenses..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Bloomberg, and Source: Le Parisien, and Source: Industry reports (2022–2023).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Limited public disclosure (spokesperson confirmed intrusion attempt).

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Forensic Analysis Of Seized Devices, Review Of Physical And Network Security Protocols, , Imo Cybersecurity Provisions, Risk Management Integration, Enhanced Monitoring, .

Last Ransom Demanded: The amount of the last ransom demanded was ['$3.2 million (extreme cases)', '$550,000 (average per attack, 2022–2023)'].

Last Attacking Group: The attacking group in the last incident were an GRU (Russian military intelligence agency, possibly Unit 29155) and Nigerian criminal networksRussiaChinaNorth KoreaIran.

Most Recent Incident Detected: The most recent incident detected was on 2020-04.

Highest Financial Loss: The highest financial loss from an incident was $550,000 (average per ransomware attack, 2022–2023).

Most Significant System Affected: The most significant system affected in an incident was Digital booking toolCompany websiteData centre and and Navigation systemsCommunicationsEmissions-monitoring sensors.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Removal of Raspberry Pi devices and forensic analysis.

Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was ['$3.2 million (extreme cases)', '$550,000 (average per attack, 2022–2023)'].

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Importance of physical security for onboard networks, network segmentation, and monitoring for unauthorized devices., The industry needs to close security gaps amid an increasingly connected, yet vulnerable, digital landscape. Outdated infrastructure and lack of modern defenses are major vulnerabilities.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Conduct regular audits of onboard networks for anomalies, Improve detection of unauthorized hardware (e.g., Raspberry Pi devices), Enhance physical security measures for restricted-access areas on vessels, Strengthen network segmentation between office and operational systems, Integrate risk management into safety systems, adopt anti-jam technology and and enhance cybersecurity awareness and defenses..

Most Recent Source: The most recent source of information about an incident are Industry reports (2022–2023), Le Parisien and Bloomberg.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Physical access via Raspberry Pi devices.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Physical security lapse allowing unauthorized device installationPotential insider assistance or lax access controls, Outdated infrastructureIncreased digitizationGeopolitical tensionsLack of modern defenses.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Forensic analysis of seized devicesReview of physical and network security protocols, IMO cybersecurity provisionsRisk management integrationEnhanced monitoring.