The phone rings at 09:00. A confident, friendly voice says he is from the AV contractor, he is finishing a job remotely, and he just needs the wifi password and someone to plug a USB stick into the media server. He knows the yacht's name, the ETO's first name and the last port. Everything about him sounds right. This is what an attack actually looks like.
The interior is a security control, whether you realise it or not
You hold the guest wifi password, you handle guest devices, you have access to every cabin, and you are the person a stranger will try to charm. Cyber security on a yacht is not only the ETO's job - it is a shipboard duty, sitting under the yacht's safety management system and its cyber-security policy, in the same way fire and safety procedures do.
The rules that matter
| Situation | The rule |
|---|---|
| Guest wifi password | Give the current password, to guests only, the way your yacht does it. It gets rotated - between charters at minimum |
| Crew or vessel network | Never hand out credentials. Never connect a guest device to it |
| Unknown USB sticks, drives, cables, dongles | Never plug them into any ship system, ever - including a guest's, however innocent |
| Someone claiming to be a contractor | Verify independently through the ETO or captain. Never act on a phone call or email alone |
| Emails asking for passwords or urgent payment | Do not click, do not reply. Report to the ETO |
| Photos of the interior, systems, racks or the guest | Never post or share. This is a confidentiality and security issue, and usually a contract breach |
| A guest device left in a cabin | Do not touch, move or explore it beyond your cleaning duties |
| Cameras on board | Know where they are and are not. Guests have a legitimate expectation of privacy in cabins and private spaces |
Social engineering: the polite attack
Attackers do not look like criminals. They sound helpful, they are in a hurry, they have some real details, and they give you a reason to skip a step. The defence is boring and effective: slow down and verify through a channel you already trust. Nobody legitimate will ever be harmed by you saying, "Let me check with our ETO and call you back." Anyone who pushes back hard on that has just told you what they are.
Guest data and confidentiality
Guest names, itineraries, health details, passwords, viewing history, what they said at dinner - none of it leaves the boat. That includes group chats, family, friends and future job interviews. Discretion is not a nice-to-have in this industry; it is the industry.
Onboard Notes
- Read your yacht's cyber-security policy and its social media policy. Know who to report a suspicious contact to.
- If in doubt, verify. If still in doubt, escalate. Neither ever gets you in trouble.
- Never plug in anything you did not get from the ETO.
- This is independent study. xplor is not an accredited training provider, and this course awards no certificate or qualification. Your yacht's documentation and the ETO's instructions always override it.