Danish Maritime Authority

In April 2012, the Danish Maritime Authority (DMA) fell victim to a sophisticated cyber espionage attack orchestrated by foreign state-sponsored hackers, suspected to be linked to China. The breach began when an employee opened a malicious PDF attachment in a phishing email, unknowingly installing a virus that granted hackers backdoor access to the DMA’s IT systems. The attackers infiltrated 13 PCs and multiple servers, eventually compromising the Business Ministry’s IT network.The primary objective was to exfiltrate confidential intelligence on Danish shipping companies and the merchant navy strategic data that could undermine national maritime security and economic interests. While the exact volume of stolen data remains undisclosed, the breach exposed sensitive operational and commercial secrets, potentially benefiting foreign adversaries in geopolitical or industrial espionage. The Chinese Embassy denied involvement, but cybersecurity analysts attributed the attack’s tactics to state-backed actors.The incident highlighted vulnerabilities in Denmark’s critical infrastructure, raising concerns over foreign interference in maritime and trade sectors. Though no immediate financial or physical harm was reported, the long-term risks included eroded trust in Denmark’s cyber defenses, possible economic espionage advantages for rival nations, and the precedent for future attacks on governmental and private maritime entities.

Source: https://www.thelocal.dk/20140922/denmark-was-hacked-by-state-sponsored-spies/

TPRM report: https://www.rankiteo.com/company/danishmaritimeaut

"id": "dan430092125",
"linkid": "danishmaritimeaut",
"type": "Cyber Attack",
"date": "4/2012",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"

{'affected_entities': [{'industry': 'Maritime',
                        'location': 'Denmark',
                        'name': 'Danish Maritime Authority (DMA)',
                        'type': 'Government Agency'},
                       {'industry': 'Public Administration',
                        'location': 'Denmark',
                        'name': 'Danish Business Ministry',
                        'type': 'Government Ministry'}],
 'attack_vector': ['phishing', 'malicious PDF attachment', 'backdoor access'],
 'data_breach': {'data_exfiltration': True,
                 'sensitivity_of_data': 'High (state-level intelligence value)',
                 'type_of_data_compromised': ['confidential maritime data',
                                              'shipping company information',
                                              'merchant navy details']},
 'date_detected': '2012-04',
 'description': 'In April 2012, hackers from a foreign state (suspected to be '
                "China) infiltrated the Danish Maritime Authority's IT systems "
                'via a malicious PDF attachment in an email. The attack '
                'targeted sensitive information on Danish shipping companies '
                'and the merchant navy. The hackers gained backdoor access to '
                '13 PCs and multiple servers, eventually compromising the '
                'Business Ministry’s IT system, leading to the disclosure of '
                'sensitive information.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
                                       'state-sponsored breach',
            'data_compromised': ['sensitive information on Danish shipping '
                                 'companies',
                                 'merchant navy data',
                                 'Business Ministry IT system data'],
            'systems_affected': ['13 PCs',
                                 'multiple servers',
                                 'Business Ministry’s IT system']},
 'initial_access_broker': {'backdoors_established': True,
                           'entry_point': 'Malicious PDF attachment in '
                                          'phishing email',
                           'high_value_targets': ['Danish shipping companies',
                                                  'merchant navy data',
                                                  'Business Ministry IT '
                                                  'systems']},
 'investigation_status': 'Suspected state-sponsored attack; China denied '
                         'involvement',
 'motivation': ['espionage',
                'intelligence gathering',
                'access to confidential maritime and shipping data'],
 'post_incident_analysis': {'root_causes': ['Human error (opening infected '
                                            'attachment)',
                                            'lack of email security controls']},
 'ransomware': {'data_exfiltration': True},
 'references': [{'source': 'Publicly reported cyber incident (2012)'}],
 'threat_actor': 'Foreign state-sponsored hackers (suspected: China)',
 'title': '2012 Danish Maritime Authority Cyber Espionage Attack',
 'type': ['cyber espionage', 'targeted attack', 'data breach'],
 'vulnerability_exploited': 'Human error (opening infected email attachment)'}