01In Korean waters
GPS jamming hit 2,137 ships
2,137ships
1,157cases
Jamming is not hacking. But a ship’s navigation equipment trusts incoming satellite signals without checking whether they are genuine.
Source · Figures submitted by Korea’s Ministry of Science and ICT to the National Assembly (reported Nov 2024)
02A collision amid jamming
A collision in the middle of the jamming
Jun 2025 · near Hormuz
Two tankers collide
About 1,000 Gulf ships were hit by GNSS interference. One ship’s position appeared inland before the collision.
UAE authorities: navigational error
Feb to Mar 2026 · the Gulf
Over 1,100 ships in 24 hours
GNSS and AIS interference counted by analysts. Positions appeared at airports and inland.
No published investigation has examined whether the jamming played a part.
Source · Windward and Lloyd’s List Intelligence analysis, reporting of the UAE Ministry of Energy statement
03Already on board
It has already come on board
2019 · a ship calling at a US port
Onboard computer network infected
The US Coast Guard investigated and published its findings. Essential control systems were unaffected, but the crew knew the risk and the ship had nothing in place to stop it.
Dec 2025 · a ferry docked in France
Crew member charged over a remote-access device
Suspected of secretly installing remote-access tools on the ship’s network. It was stopped with no damage and is under investigation.
Source · US Coast Guard Marine Safety Alert 06-19 (as reported), France 24
04Records versus experience
Few public records, many who were hit
~300cases
31%
Of six ship-level incidents we found in public sources, only one, the US case in 2019, has a published government finding. Owners avoid sharing for fear of being identified.
Source · NHL Stenden Maritime Cyber Attack Database, DNV Maritime Cyber Priority 2024/25, Allianz
05Why we can’t see them
Rarely reported. Rarely investigated.
- Report
- Investigate
- Share
The day your GPS position jumped at sea, did it go into a near-miss report? When an incident happens, who receives the report, who examines the equipment on board, and what do other ships with the same equipment get told? The next part looks at that.
06Why look inside the equipment
The cause stays inside the equipment
Sep 2026 · overseas reports
Suspected cyberattack on an LNG carrier
The cause has not been confirmed. When suspicion arises, what should investigators look at?
Embedded means a small computer built into a piece of equipment. The software running on it is called firmware. A ship carries this kind of equipment everywhere.
GPS Receiver
Position from satellite signals
ECDIS
Route and position display
Engine Control
Propulsion power
Steering Control
Rudder control
Cargo Control
Tank pressure and temperature
VDR
Voyage data recorder · records around an incident
Demo screenTraces of an attack stay in this equipment’s firmware and logs, and a reboot or a part swap wipes them. Finding the cause means looking inside the equipment.
07TGM and KR-CRP
Catch it on board, carry it into class survey
Demo screen① TGMDetects, blocks and logs on board
Watches IT and control networks together, catches abnormal signals and GNSS interference, isolates the segment and logs what happened.
Screen · MITRE ATT&CK technique mapping
Demo screen② Embedded analysisLooks inside the equipment
Pulls firmware from removed control equipment, finds what changed and which weakness was used, and adds it to TGM detection rules.
Screen · Indicator (IoC) list, values masked
Demo screen③ KR-CRPCarries it into class survey
Finds ships with the same equipment from per-ship CBS inventories, and turns response records into UR E26 evidence and survey documents.
Screen · Cyber resilience program (CSRP) document
August testbed demo · two virtual ships, seven real attack techniques detected and blocked by TGM
Ready to Comply with UR E26?
Take the 7-question assessment and get your personalized compliance roadmap — free.