The Q2 2026 Undersea Cables Risk Report

The Q2 Numbers That Matter Most

• 34,081 slow-speed vessel activities (movement of more than one hour in proximity to a known cable route) tracked globally in Q2 2026 (−2.4% vs. Q1). 
• Combined State-of-Concern activity down 57.8%, but confirmed High-IUU-risk events up 80.6%. Fewer flagged vessels. Higher-risk composition among those that remain. 
• Trawler activity up 11.8% (1,594 confirmed events). Atlantic (912) and Mediterranean (776) carry the concentration. Accidental damage remains the primary driver of cable faults, and it now has a measurable regional address.
• Iran’s service-vessel average dwell time doubled (11.1 to 23.3 hours). The signature shifted from many short events to fewer, longer ones — a pattern consistent with higher-value operations, not de-escalation.
• The May 11 SAGA case: a sanctioned Russian-flagged tanker corroborated by Electro-Optical and Synthetic Aperture Radar satellite passes over a Mediterranean cable corridor, in a single day. The working example of what modern multi-sensor detection catches, and what AIS-only monitoring will not.

From Suspected Sabotage to Confirmed Accident: Q2’s Attribution Shift

On April 9, 2026, UK Defence Secretary John Healey disclosed that a month-long British and Norwegian operation had tracked three Russian submarines conducting covert surveillance over UK undersea cables and pipelines. Two came from Russia’s Main Directorate of Deep Sea Research, the specialist unit responsible for seabed operations. The third, an Akula-class attack submarine, was assessed as a decoy. Healey’s message to Putin was direct, saying “We see you, we see your activity over our underwater infrastructure.”

Since October 2023, at least 11 subsea cables in the Baltic Sea have been damaged or cut, traced to vessels including NEWNEW POLAR BEAR, YI PENG 3, EAGLE S, and most recently, FITBURG. In March 2026, Finland’s National Bureau of Investigation confirmed that FITBURG had dragged its anchor across the Elisa cable connecting Finland and Estonia on the last day of 2025. 

The Numbers Are Down, but the Risk Is Up

Combined State-of-Concern activity across service vessels and fishing vessels fell nearly 58% quarter over quarter, from 8,042 events in Q1 to 3,393 in Q2. China-flagged fishing activity accounts for most of the drop, falling from 7,560 events to 3,055 (−59.6%). On its own, that looks like de-escalation.

The composition change beneath it tells a different story.

The UK submarine operation Healey revealed fits inside this frame. Small number of high-consequence surveys, one month long, deniable. A quarter with fewer flagged events produced the most significant public disclosure of state-directed cable surveillance in years.

State-of-Concern event counts fell this quarter, but the risk did not. The vessels driving the highest risk are not the ones showing up in the count. The signal worth acting on this quarter is composition (what share of activity is high-risk) and dwell time (how long each event lasts), not volume. A monitoring approach built around SoC volume will make Q2 look like a quieter quarter than it actually was.

Accidental Damage Concentrates in the Atlantic and Mediterranean

While State-of-Concern activity fell, one category moved in the opposite direction. Confirmed trawler events (slow-speed movement of more than one hour in proximity to a known cable route, flagged ‘Trawler’ subclass) rose from 1,426 in Q1 to 1,594 in Q2 (+11.8%), with 215 unique vessels involved compared to 179 in Q1.

Accidental damage from fishing and anchoring drives the majority of cable faults globally. Cable operators, insurers, and repair vessel operators have long treated this as the base rate. Public assessments from governments and intelligence services caught up mid-quarter.

ESCA’s June 4 Fishing Liaison Guidelines exist because of this reality. They establish an industry-level framework for engagement between cable operators and the fishing industry, addressing the primary cause of cable damage in Northern European waters.

The median global repair time for a submarine cable fault is approximately 40 days, and even under favorable Baltic conditions, restoration typically takes at least 14. Every trawler-caused fault consumes repair capacity and maintenance budget regardless of whether it makes a headline.

For cable operators, consortiums, and insurers, the Atlantic and Mediterranean concentration is decision-relevant geography. Preventive maintenance planning informed by historical vessel-density data across cable corridors turns accidental-damage exposure into scheduled infrastructure investment rather than a reactive repair cycle. For insurers, the same data supports pricing precision on routes where trawler concentration is measurable rather than assumed.

What Multi-Sensor Detection Catches

On May 11, 2026, Windward tracked the tanker SAGA (IMO 9318553), a Russian-flagged product tanker publicly sanctioned by the EU, Switzerland, U.S., Canada, UK, and Ukraine for transporting Russian crude oil and refined products in violation of sanctions, loitering directly above a Mediterranean subsea cable network near Crete. The detection was corroborated by two independent sensor systems roughly seven hours apart, an Electro-Optical (EO) satellite pass at 09:21 UTC and a Synthetic Aperture Radar (SAR) pass at 16:30 UTC. Same vessel, same position, same day.

SAGA reflagged to Russia in February 2026 after operating under fraudulent registries and reissued its MMSI in the process. The reflagging followed a roughly two-month AIS-dark period that began in the Russian EEZ and ended in the Turkish EEZ. Windward has flagged SAGA as high risk for Border Security since June 26, 2024.

The vessel was engineered to be invisible to AIS-only monitoring. Transponder data remains a foundational input, but a posture built on it alone is one a vessel can defeat by switching off its signal, a technique adversaries have already demonstrated at scale in the Baltic. Multi-source fusion is what closes that gap. In SAGA’s case, the fusion of satellite imagery (EO and SAR), sanctions and ownership records, and identity-history tracking is what surfaced the case.

Not every vessel of interest matched SAGA’s profile. The most persistent State-of-Concern service vessel by event count was a Chinese-flagged dredger conducting 14 short slow-speed events in Malaysian waters between April and June, each lasting 1.7 to 6.9 hours (33.2 cumulative hours). Frequent, short, geographically fixed events consistent with routine channel maintenance. The same analytical framework that surfaced SAGA correctly classified this pattern as maintenance behavior, not surveillance.

The SAGA case reflects where the whole subsea cable community is moving on detection standards. The EU Action Plan on Cable Security references this capability, detecting abnormal vessel behavior when AIS is off or spoofed, as an example of the kind of project Connecting Europe Facility (CEF) Digital funds. NATO’s Baltic Sentry is built on the same premise. The UK’s June 1 penalty legislation presumes the underlying detection exists. For anyone building or procuring monitoring capability, this is the standard to design toward.

The Global Regional Picture

The Pacific carries the broadest combined exposure. It is the largest single region for both service-vessel activity (4,984 events, 53.0% of global total) and fishing-vessel activity (11,181 events, 45.3%). It also carries the highest extended-presence rate of any region for service vessels (793 events exceeding 24 hours, 15.9%). China-flagged fishing activity concentrates around Kiribati, Solomon Islands, and Fiji, cable-landing geography relevant to U.S.-connected infrastructure. Indonesia leads regional fishing volume with 3,724 events, followed by South Korea (2,905) and China (2,539). 

For U.S. cable landing operators, the Research/Survey concentration is the signal to watch. Not every research vessel is a threat, but the class carries the highest per-event surveillance potential of any vessel category.

What Q2’s Data Means for Cable Operators, Insurers, and Governments

The finding is the same for all stakeholders: raw data is not enough. The analysis applied to it is what makes the difference.

For cable operators and consortiums, the trawler concentration in the Atlantic and Mediterranean is where preventive maintenance investment now has a data-supported regional address. Route-level risk mapping across cable corridors, drawing on historical vessel-density data rather than current AIS positions, converts accidental-damage exposure into a schedulable capital allocation problem rather than a reactive repair one.

For insurance underwriters and reinsurers, evidence quality is the story. The SAGA case is the working example of the multi-sensor evidence base that authorities, insurers, and courts are increasingly expecting for a covered loss determination or a subrogation claim. Pricing precision on cable routes where trawler concentration is measurable, and evidence-grade documentation of any suspected incident, are both now within technical reach.

For government maritime authorities and regulators, the regulatory calendar is defined by the current EU, UK, and NATO frames. The CER Directive designation window opened in July. The UK’s cable-damage penalty legislation is in progress. NATO Baltic Sentry is entering its second year. The Q2 data supports the direction each of these frameworks is heading. The gap that remains is enforcement bandwidth against the vessels that a multi-sensor detection posture surfaces.

For anyone monitoring the environment, volume-based screening will miss the highest-value operations this quarter. Composition, dwell time, identity history, and multi-sensor corroboration are the layers that make Q2’s actual risk picture visible.

Multi-Sensor Intelligence for Cable Protection