Wan Hai Shipping Co., Ltd.

Summary

The shipping company disclosed that its information website was hit by a cyberattack in the afternoon, prompting immediate activation of cybersecurity defenses. Upon detection, the website was isolated, and external information security vendors and experts were engaged to assist with response efforts, with notifications filed to the relevant regulatory authorities. Service on the information website was temporarily suspended as a precaution. The company stated the incident had no material impact on operations, information security, or personal data, and indicated no expected insurance claim. Going forward, the organization plans to strengthen security controls over its network and information infrastructure to safeguard information security.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On April 18, 2025, Wan Hai Shipping Co., Ltd. experienced a cybersecurity incident when the company's information website was subjected to a network hacker attack in the afternoon. According to the disclosure filed through the public information observation station, the incident was formally reported on the same day the attack occurred, indicating the company moved quickly to document and disclose the event. The company characterized the event as a network hacker attack targeting its information website, establishing the basic nature of the security breach as an external intrusion attempt against a publicly accessible web property. The timing of the attack, occurring during business hours in the afternoon, suggests the company was operating normally when the malicious activity was detected.

Upon discovering the attack, Wan Hai Shipping immediately initiated various information security protection measures to contain the situation. The company performed isolation processing on the affected website, effectively disconnecting it from broader network access to prevent potential lateral movement or further compromise. This containment action reflects a standard incident response approach of segmenting affected systems from the rest of the operational environment. In parallel with the internal response, Wan Hai engaged contracted external information security technology companies and specialists to assist with handling the incident, bringing in additional expertise to investigate the breach, assess the scope of compromise, and support remediation efforts. The company also indicated that it would follow established procedures to report the incident to the competent authorities, fulfilling regulatory notification obligations appropriate for such security events.

The immediate impact of the incident was the temporary suspension of service for the company's information website, which was taken offline as part of the isolation and containment process. Despite this disruption to the web-based information portal, Wan Hai Shipping assessed that the incident did not have a significant impact on the company's operations, information security posture beyond the affected system, or personal data. This assessment suggests that the attack was contained to the targeted website and did not extend into the company's core operational systems, customer-facing transactional platforms, or sensitive databases containing personal information. The company also noted that insurance compensation was not applicable to this incident, indicating either that no insurance claim was pursued or that the specific circumstances did not trigger applicable coverage under existing policies.

In terms of future measures, Wan Hai Shipping stated that it would continue to enhance the security controls of its network and information infrastructure to ensure information security going forward. This commitment to strengthening security posture represents the company's forward-looking response to the incident, though specific technical measures, timelines, or implementation details were not elaborated in the disclosure. The company did not identify any additional matters requiring explanation, and no specific attribution, technical details about the attack methodology, or information about the threat actors involved were disclosed in the public filing. The incident documentation provided through the regulatory channel establishes the factual record of the event as a targeted attack on the company's public-facing information website, with containment achieved through immediate isolation, external expert engagement, and regulatory reporting, while the broader organizational impact was assessed as not significant.

Sources

Sources available to members: 1 source.