Written with insights from Robert Mackay, Cyber Risk Specialist
Drawing on themes he explored during recent cybersecurity knowledge-sharing sessions, Robert Mackay examines what the Albert Heijn cyber incident can teach maritime organisations about supply-chain dependencies, operational resilience and third-party cyber risk.
Cybersecurity has been firmly in the spotlight following the recent cyber incident affecting Albert Heijn in the Netherlands. Reports suggest the disruption affected online ordering, home deliveries, customer services and parts of the retailer’s distribution network, with estimated losses already running into millions of euros. The effects were not limited to Albert Heijn alone. Disruptions extended beyond customer-facing systems and affected broader operational processes, highlighting how quickly cyber incidents can become an operational and supply-chain challenge.
Yet perhaps the most important lesson is not what happened to Albert Heijn itself, but what the incident reveals about modern business dependencies. Cyber incidents rarely remain contained within a single organisation. In today’s interconnected economy, disruption can quickly spread through suppliers, service providers, and customers, affecting businesses that were never directly targeted in the first place.
The Risk Beyond the Immediate Target
A common misconception is that cyber risk begins and ends with the organisation that is attacked. In reality, a company does not need to be hacked to suffer the consequences of a cyber incident. Businesses operate within networks of suppliers, technology providers and service partners, and the financial and operational impact is often felt far beyond the original target.
Consider a manufacturer supplying components to several shipping companies. One customer suffers a cyberattack that disrupts its procurement or port-booking systems. The manufacturer has not been attacked, and its products are ready, but it cannot obtain shipping instructions or deliver goods to the vessel. Storage costs rise, working capital is tied up, and other customers may be affected as warehouse space and transport capacity become constrained. A cyber incident at one organisation can quickly become a business interruption event for several others. The manufacturer may suffer rising storage costs, tied-up working capital and delayed deliveries, despite never experiencing a cyber incident of its own. The question then becomes: who pays for those losses?
According to Verizon’s 2025 Data Breach Investigations Report, 30% of reported breaches involved a third party, highlighting the growing role suppliers and service providers play in organisations’ cyber exposure.
For the maritime sector, this dependency is particularly relevant. Shipowners, charterers, brokers, and logistics providers rely on a complex ecosystem of ports, terminals, customs platforms, digital communications systems, software and specialist service partners. Disruptions affecting one element of this ecosystem can quickly create operational and financial consequences elsewhere in the chain.
The 2017 NotPetya attack on Maersk disrupted operations across terminals, logistics services and shipping networks globally. While Maersk was at the centre of the incident, the effects were felt across the wider logistics chain. The attack demonstrated that the most significant impacts of a cyber incident are often operational rather than technical. Vessel movements, terminal operations, and supply-chain activities can all be affected long after the initial compromise has occurred.
Start with the Critical Service
One principle consistently emerges when assessing cyber risk: start with the critical service, not the technology. Cyber incidents rarely affect only IT; they affect services, customers, and supply chains. Understanding which systems support a business process is valuable. Understanding which external dependencies enable that process is essential.
For many organisations, the real question is not whether a system could fail, but which critical services cannot stop. In maritime operations, that might include vessel turnaround, cargo release, customs documentation, or terminal access. Even relatively short periods of disruption can have wider operational consequences, including missed slots, delayed cargo movements, and knock-on effects across the wider logistics chain.
A disruption that begins in one organisation can quickly cascade through operations, customers and financial performance across an entire chain of dependencies. What starts as a technical issue can rapidly evolve into operational disruption, supply-chain impacts, and ultimately financial losses.
During recent cybersecurity knowledge-sharing sessions, a fictional terminal operator scenario based on real-world experiences demonstrated how quickly those consequences can escalate. In the scenario, a single disruption left a vessel waiting at berth; 1,400 containers blocked, and 60 trucks queued at the gate. The lesson was not the numbers themselves, but how quickly operational disruption can spread beyond the organisation directly affected and into the wider logistics chain.
Cyber Risk is Also a Business Continuity Risk
An often-overlooked distinction is that security and continuity are not the same thing. Organisations may have strong security controls yet still be vulnerable if they cannot recover quickly from an incident or if a key dependency becomes unavailable. Recoverability matters just as much as protection.
Research from IBM found that 31% of organisations affected by a breach experienced operational disruption as a result. While headlines often focus on stolen data, the most significant business impacts frequently arise from interrupted operations, delayed deliveries, unavailable services, and lost revenue.
Understanding these dependencies is also important from a risk-transfer perspective. Cyber insurance remains an important component of a risk management strategy, but one company’s cyber policy does not automatically protect the wider supply chain. Importantly, an organisation may suffer significant financial losses from a cyber incident elsewhere in the supply chain while finding that its own cyber insurance does not respond because its systems were never compromised. Organisations should understand not only their own cyber exposures, but also the potential consequences of disruption affecting critical third parties.
Instead of asking: “Could we be hacked?” They should also ask: “Which supplier, technology provider or logistics partner could stop your most critical operations without ever targeting your organisation directly?” For many businesses, the answer may reveal that their most significant cyber risk does not sit within their own organisation at all. It lies somewhere else in the chain.
What Is Your Most Critical Dependency?
Cyber security is only one part of the resilience equation. Equally important is understanding the suppliers, platforms and service providers that underpin your operations.
FDR works with organisations to identify critical dependencies, assess potential business interruption exposures and strengthen resilience across the wider supply chain. If you would like to discuss cyber risk, business continuity or supply-chain resilience, contact our team.
