France investigating ‘foreign interference’ after tracking software found on commuter ferry

French counterintelligence is probing a suspected cyberattack after Italian authorities alerted the DGSI that RAT remote-access software was detected on the computer systems of an international ferry docked in Sète; prosecutors said the malware could have been used to seize control of vessel systems, the ship underwent security checks and has since resumed service. Police arrested two crew members — a Bulgarian released without charge and a Latvian who remains in custody on preliminary conspiracy and two hacking charges alleged to have been carried out on behalf of an unnamed foreign power — and Interior Minister Laurent Nunez suggested the activity mirrors patterns of Russian 'foreign interference,' although attribution remains uncertain. The case highlights acute vulnerabilities in maritime operational technology and the attribution challenges that accompany so-called hybrid-warfare incidents.

Analysis

French counterintelligence (DGSI) opened an investigation after Italian authorities alerted them that RAT remote-access-tool malware was detected on computer systems of an international passenger ferry docked in Sète; Paris prosecutors said the software could have been used to take control of vessel systems, and the ship underwent security checks before resuming operations. Two crew members were detained after identification by Italian authorities: a Bulgarian national was released without charge, while a Latvian crew member remains in custody on a preliminary criminal conspiracy charge and two preliminary hacking charges allegedly made on behalf of an unnamed foreign power. Interior Minister Laurent Nunez linked the episode to recurring patterns of "foreign interference," implicitly referencing Russia, but officials stressed attribution remains uncertain amid the broader context of alleged European hybrid-warfare activity. The incident underscores acute vulnerabilities in maritime operational-technology environments, raises potential regulatory and insurance implications for ferry operators and ports, and—per the supplied signals—has produced moderately negative sentiment while market impact to date appears limited but could lift demand for cybersecurity and OT-protection services if investigations expand.

Key Decisions for Investors

• Monitor short-term exposure to European ferry operators, port services and marine insurers and consider hedges until investigation outcomes and regulatory responses are clearer
• Increase surveillance of cybersecurity and operational-technology security vendors that serve maritime and transportation customers as a potential beneficiary if procurement cycles accelerate
• Watch attribution developments and government statements closely because clear linkage to a state actor would raise geopolitical risk premia, regulatory scrutiny and potential liability for affected transport operators