Hapag-Lloyd AG

In March 2022, Hapag-Lloyd, a global shipping and container transportation company headquartered in Hamburg, Germany, fell victim to a **spear-phishing attack**. Cybercriminals created a **malicious replica of the company’s official website** and distributed hyperlinks via email to unsuspecting users. When employees or customers clicked these links and entered their login credentials, the attackers **harvested their personal data**, including usernames, passwords, and potentially other sensitive information.The company’s IT security team detected the fraudulent website and immediately issued warnings to users, advising them to **avoid clicking email links** and instead manually type the website URL to prevent further data theft. While the attack primarily targeted **user credentials**, the compromise of personal data posed risks of **follow-on fraud, identity theft, or unauthorized access to corporate systems**. Hapag-Lloyd took mitigative steps to contain the incident, but the breach highlighted vulnerabilities in **user awareness and email-based threat vectors**.The attack did not result in large-scale financial losses, operational disruptions, or systemic damage to the company’s infrastructure. However, the **theft of personal data**—even if limited to login credentials—exposed customers and employees to potential downstream risks, including **phishing escalation or credential-stuffing attacks** on other platforms.

Source: https://www.freightwaves.com/news/hapag-lloyd-faces-cyberthreat-after-criminals-create-fake-website

TPRM report: https://www.rankiteo.com/company/hapag-lloyd-ag

"id": "hap508092125",
"linkid": "hapag-lloyd-ag",
"type": "Cyber Attack",
"date": "3/2022",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'shipping/logistics',
                        'location': 'Hamburg, Germany',
                        'name': 'Hapag-Lloyd',
                        'type': 'company'}],
 'attack_vector': 'email (malicious hyperlinks)',
 'customer_advisories': ['recommendation to manually enter website URL instead '
                         'of clicking links'],
 'data_breach': {'data_exfiltration': True,
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'high (personal authentication data)',
                 'type_of_data_compromised': ['user credentials (usernames, '
                                              'passwords)']},
 'date_detected': '2022-03',
 'date_publicly_disclosed': '2022-03',
 'description': 'In March 2022, the Hamburg (Germany)-based Hapag-Lloyd head '
                'office was hit by a spear-phishing attack. The IT security '
                'team discovered a copy of its website, which was being used '
                'by criminals. The criminals sent hyperlinks via email to '
                'redirect users to the fake site. Once users logged in, the '
                'criminals were able to steal their personal data. After '
                'detecting the incident, the company warned users about '
                'incoming emails and recommended accessing the website by '
                'manually entering the URL instead of clicking on links.',
 'impact': {'brand_reputation_impact': 'potential reputational damage due to '
                                       'phishing incident',
            'data_compromised': ['personal data (user credentials)'],
            'identity_theft_risk': 'high (stolen credentials could lead to '
                                   'identity theft)',
            'systems_affected': ['fake website (spoofed Hapag-Lloyd site)']},
 'initial_access_broker': {'entry_point': 'spear-phishing email (malicious '
                                          'hyperlink)',
                           'high_value_targets': ['user credentials']},
 'investigation_status': 'detected and mitigated (public warning issued)',
 'motivation': 'data theft (personal data)',
 'post_incident_analysis': {'root_causes': ['Successful spoofing of '
                                            'Hapag-Lloyd website via phishing '
                                            'links.',
                                            'User susceptibility to phishing '
                                            'emails.']},
 'recommendations': ['Educate users on recognizing phishing emails and spoofed '
                     'websites.',
                     'Implement multi-factor authentication (MFA) to mitigate '
                     'credential theft risks.',
                     'Monitor for fake domains or websites impersonating the '
                     'company.'],
 'references': [{'source': 'Hapag-Lloyd public advisory (March 2022)'}],
 'response': {'communication_strategy': ['public advisory to users'],
              'containment_measures': ['warning users about phishing emails'],
              'incident_response_plan_activated': True,
              'remediation_measures': ['recommending manual URL entry instead '
                                       'of clicking links']},
 'stakeholder_advisories': ['warning to users about phishing emails'],
 'title': 'Spear-Phishing Attack on Hapag-Lloyd (March 2022)',
 'type': 'spear-phishing',
 'vulnerability_exploited': 'user trust in legitimate-looking emails/websites'}