The Cyber War Lurking Behind the Hormuz Crisis

The global focus on the Strait of Hormuz has been almost entirely physical — vessel safety, route diversions, fuel costs, and cargo delays. But there is another front to this crisis, one that is less visible, harder to insure against, and in many ways more consequential: the cyber front.

Since airstrikes began on Iran at the end of February, the Strait of Hormuz has become a focal point for maritime physical security. What is getting less attention is Iran's parallel capability in cyberspace. Over the last twelve years, Iran has moved from a second-tier cyber threat to one of the leading sponsors of geopolitical cyberattacks, blending state-sponsored espionage with the broader cybercrime ecosystem. That evolution has not paused because the guns are firing.

A November 2025 Wake-Up Call

The risk is not theoretical. In November 2025, a hacking group calling itself Imperial Kitten successfully penetrated the network of a ship's Automatic Identification System (AIS), with the explicit goal of gaining access to critical shipping infrastructure. The hackers went further — gaining access to closed-circuit television (CCTV) cameras installed on a maritime vessel, providing real-time visual intelligence to hostile actors. Exploiting these vulnerabilities was, by all accounts, shockingly easy. Insufficient security investment made it possible.

Today's vessels run on sophisticated computer systems storing sensitive information: cargo manifests, crew and guest passport information, navigational routes, terminal and port information, and more. These are exactly the data types that experienced hackers want. And yet, most ship owners' security budgets remain woefully small — often only $300 to $1,000 a month. Compared to the cybersecurity investment of landlocked enterprises of comparable revenue, this is strikingly underfunded.

The $175,000 Argument

The financial logic for upgrading is not complicated. Ship owners routinely spend between $175,000 and $3 million per month on fuel alone. Allocating just 1% of that single operational expense toward a robust cybersecurity strategy would not be a budget line item — it would be a comprehensive insurance policy for the vessel's data, crew safety, and corporate reputation. In an era of digital warfare, a 1% investment is a small price to pay to prevent a 100% loss.

Contrast that with the cost of a vessel stuck in port for mechanical or cyber-related reasons, which is estimated at up to $100,000 per day. Attempting to save $200 a month on security budgets could leave a shipping firm liable for billions in damages, poor stock performance, and reputational damage that is difficult to overcome. That is not a hypothetical risk — it is a ticking financial time bomb.

Downtime Creates Vulnerability

The current crisis has introduced a specific new exposure vector. Crews stuck in the Strait of Hormuz with forced downtime are heavily relying on personal devices and unsecured ship networks. This surge in connectivity creates massive, exploitable blind spots — allowing attackers to directly compromise a vessel's network, stored data, and broader business operations.

Connected vessels are a hacker's dream, yet ship owners continue to invest the bare minimum in security. This false economy leaves critical systems exposed to potential hostile takeover, risking a ship being run ashore or held hostage. When a ransomware attack cripples a vessel in port, the cost of saving a few hundred dollars on cybersecurity becomes an immediate, catastrophic corporate loss.

Mindset Is the Real Challenge

The biggest challenge in maritime cybersecurity is not the technology — it is the mindset. Many organisations still see robust security as too expensive, making it difficult to convince stakeholders that these measures are a necessary investment against sophisticated hackers. While direct cyberattacks in the current conflict have not yet been confirmed, ransomware, data leaks, social engineering hacks, and other digital disruptions are becoming increasingly inevitable. It is no longer a matter of if, but when.

At 20cube, digital resilience is not a department — it is a design principle. As geopolitical risk converges with cyber risk across global shipping lanes, the businesses that treat security as infrastructure rather than overhead will be the ones that keep their operations intact when the next attack lands. The Hormuz crisis has made that investment case impossible to ignore.