Cyberattack hits MARINA, hacker leaks sensitive data

The Maritime Industry Authority (MARINA) of the Philippines has become the latest victim of a cyberattack, exposing sensitive data belonging to ship owners and Filipino seafarers. This breach follows a string of high-profile attacks attributed to the hacker known as “ph1ns.”

The breach was announced by ph1ns on Breach Forums, an online platform often used to publicize and sell stolen data. The hacker presented samples of the compromised data, raising serious concerns about the privacy and security of affected individuals. The hacker presented samples of the compromised data and left a message on the defaced servers.

In an email interview, the hacker provided additional details about a recent data breach. The breach reportedly affects primarily employees, with the number of individuals impacted estimated to be between a few dozen and a few hundred. Approximately 20 gigabytes of data were exfiltrated using an Unrestricted File Upload vulnerability. Ph1ns noted that this hack was as easy to execute as previous hacks on the Philippine National Police (PNP) but easier than the Department of Science and Technology (DOST) breach, which was more challenging due to better network separation and the need to sift through files to find credentials in backups.

Despite the attack, ph1ns has a good impression of what the DICT is doing. “I really want the government to take cybersecurity more seriously. The DICT is doing good work, but there should be a global awareness about the importance of good security practices, especially amid growing tensions with China”, the hacker said. He, however, observes that following the PNP breaches, authorities had promised to collaborate with white hat hackers to secure their systems. However, weeks later, there has been no progress. “There’s still no direct way to contact the government agencies if you’re expecting an answer and/or want updates regarding what you submitted,” he added.

ph1ns, believed to be based in the Philippines, has gained notoriety for targeting various government agencies and organizations within the country. The hacker has been linked to previous breaches of the Department of Science and Technology (DOST), the Philippine National Police (PNP), the Agricultural Credit Policy (ACP), the regional offices of the Department of Agriculture (DA), and numerous other government and private entities.

MARINA, which is tasked with integrating the development, promotion, and regulation of the maritime industry in the Philippines, confirmed the cyber attack on four of its web-based systems on Saturday, June 16, 2024.

In a statement, MARINA said that officials and employees were immediately mobilized to the Central Office to implement swift measures to secure the integrity of the affected systems. The agency aims to have the systems operational again by Tuesday, June 18, to resume accepting applications.

The MARINA assures the public that the agency is committed to maintaining the security of its systems and protecting the information of its stakeholders.

Further updates regarding the incident will be provided by MARINA as they become available.

The hacker claims that data taken from the MARINA system includes personal information such as names, addresses, contact details, and potentially even financial records. This information could be exploited for various malicious purposes, including identity theft, phishing scams, and extortion.

The MARINA breach like other breaches shows the growing threat of cyberattacks against government agencies and critical infrastructure. It highlights the need for robust cybersecurity measures to protect sensitive data and prevent unauthorized access.

As the maritime industry plays a vital role in the Philippine economy, the breach could have far-reaching implications. The exposure of seafarer data could undermine trust in the industry and jeopardize the safety and security of maritime operations.

The incident has prompted calls for a thorough investigation and swift action to mitigate the damage caused by the breach. Stakeholders are urging MARINA to provide transparency and communicate effectively with affected individuals, offering support and guidance on how to protect themselves from potential harm.

The MARINA breach reminds us of the ever-present cyber threats facing individuals and organizations alike. It emphasizes the importance of vigilance, proactive security measures, and timely response to mitigate the risks posed by cybercriminals.

Below is the statement from MARINA:

MARINA PRESS STATEMENT

June 16, 2024

ON THE CYBER ATTACK OF ITS WEB-BASED SYSTEMS

The Maritime Industry Authority (MARINA) confirms that four (4) of its web-based systems were attacked and compromised this morning, June 16, 2024.

Concerned MARINA officials and employees were immediately deployed today at its Central Office to implement expeditious measure to ensure the protection of the integrity of the systems and to have them operational to receive applications on Tuesday, June 18 2024.