When a teenager can reroute oil tankers, your business has a problem
The story sounds like a movie plot: a 15-year-old student in Southern Europe starts by hacking into his school’s digital grade system, turning mediocre marks into perfect scores. Within months, he escalates to something far more dangerous — manipulating the navigation routes of oil tankers crossing the Mediterranean Sea. But this is not fiction. It is a real incident that exposes a terrifying truth about operational technology security across Europe.
For business owners who think cyberattacks only target banks and government agencies, this case is a wake-up call. If a teenager with no formal training can breach critical maritime infrastructure, what does that say about the security posture of your company’s industrial systems, building controls, or connected devices?
What is OT security, and why should you care?
Operational technology refers to the hardware and software that monitors and controls physical processes. Think of factory production lines, HVAC systems in office buildings, warehouse logistics platforms, water treatment facilities, and yes — maritime navigation systems. Unlike traditional IT systems that handle data, OT systems move things in the real world.
The convergence of IT and OT has accelerated rapidly. A 2023 report by Fortinet found that 75% of OT organisations experienced at least one intrusion in the previous year. Eurostat data shows that over 40% of EU businesses with more than 10 employees now use some form of IoT or connected industrial device. For Italian SMBs, particularly in manufacturing, logistics, and food production — sectors that form the backbone of the economy — the attack surface has grown enormously.
The problem is straightforward: many of these systems were designed decades ago, long before anyone imagined they would be connected to the internet. They often run outdated software, use default passwords, and lack basic authentication mechanisms. A curious teenager with access to publicly available hacking tools and online tutorials can find and exploit these weaknesses.
How a 15-year-old exposed critical infrastructure gaps
The teenager reportedly used well-known techniques that are neither sophisticated nor novel. He scanned for exposed systems using tools freely available online, identified vulnerable targets, and exploited weak or default credentials. The school grade manipulation was his training ground. The maritime systems were his next target, likely discovered through the same scanning methods.
What makes this case particularly alarming is the chain of escalation. Modifying ship routes in one of the world’s busiest maritime corridors could have caused collisions, environmental disasters, or disrupted supply chains affecting thousands of businesses. The Mediterranean handles roughly 20% of global shipping traffic, and Italian ports like Genoa, Trieste, and Gioia Tauro are critical nodes in European trade.
This incident also highlights a pattern documented by ENISA, the European Union Agency for Cybersecurity. In its 2024 Threat Landscape report, ENISA noted a significant increase in attacks targeting transport and logistics sectors, with many originating from low-skill actors exploiting basic vulnerabilities. The barrier to entry for cyberattacks on operational systems has dropped dramatically.
What this means for European SMBs
You might think that maritime navigation systems have nothing to do with your 50-person manufacturing company or your regional logistics firm. But the underlying vulnerabilities are identical. If your business uses any connected industrial equipment, building management systems, or IoT devices, you face the same category of risk.
Here are the practical implications:
Default credentials are still everywhere. Many industrial devices ship with factory-set usernames and passwords that are never changed. A 2024 study by Nozomi Networks found that default or weak credentials were the entry point in over 30% of OT-related incidents. Changing them is the simplest security measure you can take, yet it remains widely neglected.
Network segmentation is not optional. Your industrial systems should never sit on the same network as your email servers and employee laptops. If an attacker compromises one system, segmentation prevents them from reaching everything else. The NIS2 Directive, which EU member states including Italy were required to transpose into national law by October 2024, explicitly mandates risk-based security measures including network architecture controls.
Visibility is half the battle. You cannot protect what you cannot see. Many SMBs have no inventory of their connected devices, no monitoring of OT network traffic, and no incident detection capability. Basic network monitoring tools can flag unusual activity before it becomes a crisis.
NIS2 and the regulatory pressure on Italian businesses
The NIS2 Directive has expanded the scope of EU cybersecurity obligations significantly. It now covers sectors like manufacturing, food production, waste management, and postal services — areas dominated by SMBs in Italy. Companies in these sectors must implement appropriate security measures, report significant incidents within defined timeframes, and ensure supply chain security.
Non-compliance carries financial penalties that can reach €10 million or 2% of global annual turnover. Beyond fines, the directive allows member states to hold management personally liable for cybersecurity failures. This is no longer a problem you can delegate entirely to your IT provider and forget about.
Practical steps to protect your business
The good news is that defending against the type of attack this teenager carried out does not require a massive budget. It requires discipline and awareness.
Audit your connected devices. Create a complete inventory of every system connected to your network, especially those controlling physical processes. Include devices you might overlook: smart thermostats, IP cameras, access control panels, and industrial sensors.
Update and patch relentlessly. If a device can be updated, update it. If it cannot be updated because it runs legacy software, isolate it from the rest of your network and monitor it closely.
Train your people. The human element remains the weakest link. Employees need to understand that operational systems are targets, not just office computers. Even basic awareness training reduces risk significantly.
Engage with your supply chain. Ask your vendors and partners about their security practices. Under NIS2, supply chain security is your responsibility too. If a third-party system connected to your network is compromised, the consequences land on your doorstep.
The real lesson from this story
A teenager did not need advanced skills, expensive tools, or insider access to threaten critical infrastructure. He needed curiosity, time, and systems that nobody bothered to secure properly. The same conditions exist in thousands of European businesses right now.
The question is not whether your company will face a cyber threat targeting its operational systems. The question is whether you will be prepared when it happens.
Need support on this topic? Contact us for a free consultation — let’s assess your company’s situation together.
Stay updated every week on cybersecurity, AI and technology for SMBs: subscribe to our newsletter.