A quarterly review by Risk Intelligence covered maritime security events and associated concerns across Asian waters throughout the July-to-September 2026 period. Theft and armed robbery boardings posted further reductions over the period, while narcotics concealment within sea chests by smugglers was noted across Asian waters, and a cyber intrusion disrupted container terminal operations at one port.
Narcotics trafficking and cyber-attacks drew attention as areas of change, even as armed robberies and theft figures held to a downward path. Theft and armed robbery during ship boardings remained the defining pattern of maritime incidents logged across Asia, with the third quarter extending a downward trend in overall numbers.
While the overall tally of recorded incidents declined, the range of activity broadened — moving beyond the boardings tied to theft and armed robbery that have long defined the area into concealment techniques for narcotics seldom encountered in this part of the world, along with an isolated incident in the cyber domain.
Across the Asia region, the combined tally of recorded incidents — spanning armed robberies, theft, drug smuggling, and cyber-attacks — retreated from 40 in the second quarter to 23 in the third, a decline of 43 per cent. Tallied against the year-prior quarter, the Q3 2025 figure of 23 incidents represented an 18 per cent reduction from the 28 recorded in Q3 2026.
When theft and armed robbery incidents are separated out, vessel boardings of this kind dropped by half between the second and third quarters — sliding from 28 recorded cases down to 14. Relative to the third quarter of 2025, the figure dropped by 44 per cent. A drop in vessel boardings through the Singapore Strait — a pattern that took hold after gang members were detained on Batam, Indonesia, in July 2025 — is reflected across the data presented in the review.
Beyond piracy, the range of threats facing vessel crews and port operators points to a broader set of operational vulnerabilities across the maritime sector. Data from the second and third quarters point to a broadening threat landscape for shipping operators running fleets across Asian waters, where risks now extend beyond the traditional concerns of theft and armed robbery that have long defined the region's maritime security picture — a pattern that mirrors developments seen in other parts of the world.
Theft and armed robbery made up the bulk of recorded offences across the third quarter of 2025. By the time Q2 and Q3 of 2026 arrived, the scope of offences covered across those filings had broadened noticeably.
Seven vessels — the majority positioned across the Indian Ocean — were intercepted by naval personnel carrying out restrictions on access to Iranian ports throughout the second quarter. No blockade-linked activity appeared across Asian maritime zones in the third quarter, though enforcement teams in the region stepped up interdiction efforts targeting concealment techniques that narcotics traffickers had not previously deployed on a wide scale.
Aboard two vessels riding at anchor, enforcement teams uncovered roughly 36 kg of cocaine packed into the sea chest strainers during boardings of each ship. In both seizures, the cocaine was moving through as transit cargo rather than being directed toward Singapore as a final destination, officials noted.
A comparable incident had already unfolded in November 2025, when a vessel that had called at Singapore after departing Brazil — with Hong Kong, Shanghai, and Ningbo among its port stops — was found to be carrying 417 kg of cocaine packed inside a sea chest. Hiding contraband inside a vessel's sea chest has become a well-documented method for moving narcotics along trafficking routes that connect South and Central America to destinations in North America and Europe.
Historically uncommon across Asian shipping routes, this concealment method — in which contraband is hidden within a vessel's sea chest — could see growing use if South American smuggling networks redirect their activities toward Asian markets in response to tightened enforcement across the eastern Pacific and Caribbean.
A Tanzania-registered general cargo ship intercepted near Tanjung Parit in the Malacca Strait was found to be carrying more than 2.6 tonnes of methamphetamine in liquid form, with Indonesian enforcement teams taking the vessel and its cargo into custody. Eight drums and the vessel's water tanks yielded a hidden cache of narcotics when personnel from Indonesia's National Narcotics Agency and Riau Islands police moved through the craft during the joint operation. After being brought under tow to Batam, Indonesia, the ship came to rest there while ten crew members of Myanmar nationality were placed under detention.
A fishing vessel registered under Tanzania's flag was stopped by Indonesian naval forces roughly 25 nautical miles from Kota Tinggi, Malaysia, in the South China Sea. Among the cargo, authorities discovered 65 sacks containing approximately 1.3 tonnes of ketamine, a haul with an estimated street value of $16.2 million. Of the eight people taken into custody, seven held Myanmar nationality and one carried Taiwanese citizenship. According to a statement from authorities, the haul ranks among the largest narcotics confiscations recorded in the nation's history.
Each of the narcotics seizures — involving hidden quantities of cocaine, methamphetamine, and ketamine — unfolded aboard vessels navigating the Singapore Strait, the Malacca Strait, and the South China Sea during the month of August. Historically in that area, those running contraband relied on privately owned small vessels rather than cargo ships, though hidden shipments did occasionally travel inside freight containers.
Patterns across the other cases point to some level of crew participation — whether under pressure or not — whereas the fishing vessel may represent a different situation altogether, underscoring the value of keeping all personnel alert to indicators of smuggling.
A breach of the Port of Tanjung Pelepas (PTP) container terminal's operating systems was carried out by an unauthorised intrusion during September. Containment of the compromised systems pulled container-handling activity to a halt for a period. To manage the flow of export containers and free-zone inter-terminal transfers during the recovery period, PTP shifted to hand-operated gate-in procedures at entry points.
Disruption stayed within the landside processing area rather than spreading further through operations. Holdup notices for a handful of vessels surfaced across the network, yet the broader rhythm of inbound and outbound traffic held largely to its timetable. A controlled restart of activity got under way within a day, and over the following five days both shore-side and vessel operations gradually steadied until normal working levels were fully restored.
Ransomware outfit Direwolf, previously linked to intrusions across several nations, claimed responsibility for the breach and put the affected organisation on notice that stolen internal records would be released unless payment discussions got under way. No indication of unauthorised access to customer data was found, according to a statement put out by PTP.
Port infrastructure in Asia has faced digital intrusions before, even if such incidents have occurred only occasionally. A destructive piece of malware known as NotPetya tore through APM Terminals' worldwide infrastructure in June 2017, leaving port operations at facilities including Mumbai and Yokohama unable to handle cargo and setting off a freight backlog that took days to work its way out of supply chains. Volumetric flood attacks targeting IT infrastructure at a handful of regional ports in June 2023 produced temporary service interruptions, though day-to-day port operations remained largely unaffected.
No documented case has yet emerged in which threat actors managed to seize navigational control of a vessel at sea or shut down its onboard systems to extract payment from the operator — even as port facilities and container terminals have faced a number of intrusion attempts over the years. Hackers breached the onboard systems of a Liberian-flagged crude carrier traversing the Mediterranean that August, tampering with engine controls and knocking out both the vessel's monitoring and alert functions — yet no demand for payment ever materialised. What unfolded put on display the operational reach of those involved and raised questions about how cyber activity might intersect with maritime safety.
