MARINA promised stronger security, so what went wrong?

DECODED: TECH, TRUTH, AND THREATS

In July 2024, the Maritime Industry Authority (MARINA) assured the public that its new Blockchain-Enabled Automated Certification System (BEST) would strengthen data security, with blockchain providing additional protection for records and transactions.

Now, MARINA has confirmed that its Seafarer’s Identity Document (SID) and Seafarer’s Record Book (SRB) systems were hit by a cyberattack on August 13, 2026, forcing the suspension of regular SID/SRB processing nationwide.

To be clear: there is currently no evidence that MARINA’s blockchain system itself was hacked. BEST and SID/SRB are not necessarily the same system.

But MARINA’s own development plans said that the integration of SID and SRB regulatory processes with MARINA Integrated Seafarers Management Online System (MISMO) would eventually form part of BEST.

So there are important questions that need answers:

1. As of August 13, 2026, had the SID/SRB system already been fully or partially integrated with BEST?

2. If yes, was any component connected to BEST affected by the cyberattack?

3. If SID/SRB had not yet been integrated with BEST, what is the current status of the integration that MARINA previously planned?

4. What exactly was compromised on August 13? Was this simply a service disruption, or did the attackers gain unauthorized access to MARINA’s systems?

5. Was any personal information exfiltrated? More importantly, was biometric information, including data associated with facial recognition and biometric enrollment, exposed or accessed?

6. How did the attackers get in? Was the vulnerability in MARINA’s application, server, network, credentials, third-party provider, or another component?

7. Why did the attack result in the nationwide suspension of regular SID/SRB processing? What happened to the system’s business continuity and disaster recovery mechanisms?

8. Who was responsible for maintaining and securing the affected SID/SRB infrastructure at the time of the attack, and what cybersecurity obligations were included in the contract?

Blockchain is not a magic shield against cyberattacks. It can protect the integrity of certain records, but an information system is only as secure as its weakest component.

MARINA deserves the opportunity to explain what happened. But Filipino seafarers whose identities, records and potentially sensitive personal information are entrusted to these systems also deserve clear answers.

The issue is no longer simply whether MARINA uses blockchain.

The question is: What exactly was attacked, what data was exposed, if any, and were the security measures taxpayers paid for sufficient to protect our seafarers?