← All incidents
Incident dossier · Rank #27
Red Sea Subsea Cable Cuts — Rubymar Anchor Severs AAE-1, Seacom/TGN-EA and EIG off Yemen
AAE-1 / EIG / Seacom / Tata (TGN) consortia
2024-02-24
3408h 0m core impact
NetworkSupply chain
On 24 February 2024 three submarine cable systems — Seacom (which Kentik groups with TGN-EA), AAE-1 and EIG — were severed off the west coast of Yemen in the Red Sea. The generally-accepted cause is the anchor of the MV Rubymar, an abandoned cargo ship struck by Houthi forces on 18 February, dragging across the cable corridor after the anchor was dropped when the vessel came under fire. The cuts degraded a large share of Asia-Europe-Middle-East transit (commonly cited at ~25%, though that figure is unattributed in reachable sources) and were felt across East Africa and the Middle East. Physical repair did not begin until July 2024, when an E-Marine cable ship restored AAE-1 first and then the remaining two cables. The cause is the accepted narrative rather than a forensic consortium finding; TGN-EA is named alongside Seacom by Kentik, but whether it is a physically distinct 4th cable or shares the Seacom system remains only partly corroborated.
Failure cascade
Trigger → primary fault → downstream blast radius, derived from the sourced root cause and affected-services record.
Facility & location
- Operator
- AAE-1 / EIG / Seacom / Tata (TGN) consortia
- Data center
- Red Sea cable corridor (Bab-el-Mandeb / off west coast of Yemen)
- Location
- Bab-el-Mandeb, Yemen
- Date
- 2024-02-24
Impact & scale
- Users affected
- Reported as tens of millions across East Africa and the Middle East in the seed brief, but UNCORROBORATED — no reachable source provides an absolute affected-user count; documented impact is country-level connectivity degradation plus one operator's earnings hit.
- Financial
- Not disclosed in absolute terms. Only quantified figure: Seacom's contribution to 30%-shareholder Remgro's headline earnings fell to ~R2M from ~R32M the prior year (~R30M / ~94% drop), attributed mainly to once-off cable-repair costs. Absolute repair spend never published.
- Scope
- Major regional connectivity incident — multi-cable, multi-country, ~5-month restoration
Services / systems down
- Seacom submarine cable (Kentik lists the damaged system as 'Seacom/TGN-EA')
- AAE-1 (Asia-Africa-Europe-1)
- EIG (Europe India Gateway)
- ~25% of Asia-Europe / Asia-Middle-East transit capacity degraded (screening estimate, unattributed)
Impact data & metrics
| Subsea cable systems severed | 3 (Seacom/Tata TGN-Eurasia, AAE-1, EIG); HGC reportedly cited 4 |
| Asia-Europe / Red Sea capacity lost | ~25% ('a quarter') |
| End-user traffic loss observed (Feb 22-28) | ~0 (no material loss across affected East-African markets) |
| Vessel drift distance while not under command | >70 km (43 mi) by 26 Feb 2024 |
| Anti-ship missiles fired at Rubymar | 2 (one struck) |
| Crew evacuated | 24, by container ship Lobivia |
| Restoration time (AAE-1) | ~4-5 months (pending 13 May 2024 -> completed July 2024) |
| Detection date of cable damage | 24 Feb 2024 (Cloudflare); exact UTC not published |
| Industry baseline: faults from anchors/fishing | ~70-80% of all cable faults |
| Vessel profile | ~171 m bulk carrier, built 1997; fertiliser cargo (press/CENTCOM: ~21,000 t ammonium-phosphate-sulphate) |
| Fault-water depth regime | shallow Bab-el-Mandeb corridor where dragged anchors hook armoured cable |
Magnitude profile
Magnitude 7.0 = blast 8×0.35 + users 7×0.25 + financial 4×0.20 + duration 8×0.20 (sub-scores 0–10 · weighted composite)
Blast radius and duration dominate: multiple international backbones down for roughly five months across a chokepoint carrying a large share of Asia-Europe traffic. User score is provisional — the 'tens of millions' figure is uncorroborated. Financial score is low because only one operator's ~R30M earnings delta is documented; the absolute repair bill and wider economic cost were never disclosed.
Sequence of events (SOE)
- TRIGGER Houthi forces fire two anti-ship missiles at MV Rubymar off Yemen; one strikes, severely damaging and disabling the Belize-flagged, Lebanese-operated (GMZ) bulk carrier (~171 m, built 1997, Marshall Is.-registered owner).
- TRIGGER All 24 crew evacuated by the container ship Lobivia; the disabled, not-under-command vessel is left adrift with its anchor down.
- CASCADE Unmanned vessel 'moved more than 70 kilometres (43 mi) while not under command', dragging its anchor across the Bab-el-Mandeb seabed cable corridor.
- IMPACT Under the leading hypothesis the dragging anchor shears three armoured subsea systems — Seacom/Tata TGN-Eurasia, AAE-1 and EIG; Wikipedia calls it 'One hypothesis' and the cause 'currently unknown'.
- DETECTION Optical continuity lost; operators' line-monitoring/OTDR systems register faults at measured distances; Cloudflare Radar dates the cable damage to 24 Feb 2024 and names the three systems.
- DETECTION Loss observed out-of-band via BGP routing changes, latency and traffic monitoring by Kentik (Doug Madory), Cloudflare Radar and NetBlocks — no facility alarm involved.
- DETECTION Cloudflare: 'no loss of traffic was observed across these countries in Cloudflare Radar' (Tanzania, Kenya, Uganda, Mozambique) — fault visible on capacity/routing telemetry while end-user traffic stayed up.
- MITIGATION Operator HGC reported rerouting affected traffic onto surviving cables and terrestrial paths (protection switching, not suppression).
- MITIGATION Affected wavelengths dropped and re-groomed onto surviving fibres and parallel/terrestrial routes — optical-layer isolation of the severed segments.
- IMPACT Roughly a quarter (~25%) of Red Sea / Europe-Asia-Middle East capacity lost; Wikipedia states the damage 'affected 25% of the internet traffic between Europe, Asia and the Middle East'.
- IMPACT Despite the capacity loss, Cloudflare telemetry shows little-to-no end-user traffic loss — parallel and terrestrial diversity absorbed the load.
- CASCADE MV Rubymar sinks, ending the drift.
- RECOVERY Repair-ship dispatch gated by war-risk: active missile/drone threat, war-risk insurance and naval-security constraints delay intervention for months.
- RECOVERY AAE-1 repairs still 'pending due to the refusal of permits from the Yemeni Government'.
- RESTORED 'In July 2024, repairs were successfully carried out on the AAE-1 cable' — an ~4-5 month restoration versus the days-to-weeks typical in a permissive environment.
- RESTORED No consortium- or regulator-issued root-cause report published; cause officially 'currently unknown' — the record remains telemetry-vendor analysis plus press.
Root cause
PROXIMATE MECHANISM (mapped from "ignition source / equipment" — this is a mechanical cable-severance incident, not a fire, so no ignition, combustion chemistry, or equipment make/model applies). The damaging "equipment" was the bower anchor and chain of the MV Rubymar — a Belize-flagged, Lebanese-operated (GMZ Ship Management Company S.A.) bulk carrier of about 171 m, built 1997, whose registered owner is Golden Adventure Shipping S.A. (Marshall Islands); she was laden with fertiliser (widely reported by press/CENTCOM as ~21,000 t of ammonium-phosphate-sulphate). On 18 Feb 2024 Houthi forces fired two anti-ship missiles off Yemen; one struck the Rubymar, severely damaging and disabling her, and all 24 crew were evacuated by the container ship Lobivia (Wikipedia "MV Rubymar"). The abandoned, not-under-command vessel was left adrift with its anchor down and, per Wikipedia, "by 26 February it had moved more than 70 kilometres (43 mi) while not under command," dragging across the Bab-el-Mandeb seabed cable corridor. Under the leading hypothesis the dragging anchor severed several undersea cables (Wikipedia "MV Rubymar": "its dragging anchor may have damaged several undersea internet cables"). The Rubymar sank on 2 March 2024. A dragged anchor hooking and shearing armoured cable in the shallow Bab-el-Mandeb corridor is the classic, ICPC-documented top fault mode.
ATTRIBUTION IS UNPROVEN — this must be stated plainly. No operator or investigator published a positive, instrumented root cause tying the specific anchor to the specific breaks (no recovered anchor marks, no matched fault-coordinate-versus-anchor-track survey). Wikipedia "AAE-1" labels it "One hypothesis for the source of the damage" and says the cause is "currently unknown"; the attribution rests only on temporal and spatial coincidence (drift window 18-26 Feb, cuts ~24 Feb, same corridor). The Houthis denied targeting cables; alternative explanations were floated but unsubstantiated.
LATENT ROOT (the real systemic lesson). The design/redundancy failure is ROUTE CONCENTRATION: three independent systems — Seacom/Tata TGN-Eurasia, AAE-1 and EIG (Cloudflare Radar names exactly these three; HGC was reported to count four) — share the same narrow, contested off-Yemen corridor, so a single seabed event severed all at once. There is no enforced anchoring-exclusion or cable-protection zone there. The "maintenance/procedure" lapse is not a cable-O&M defect — the cables were in normal service and failed to external mechanical impact — but a maritime and governance one: a war-damaged, abandoned vessel was left adrift with its anchor down in a known cable corridor with no timely salvage or anchor-recovery (the security environment prevented it), and there was no agreed permitting/safe-passage regime for repair ships — Wikipedia records AAE-1 repairs stalled "due to the refusal of permits from the Yemeni Government." The ICPC baseline (~70-80% of cable faults from accidental human activity such as fishing and anchors) confirms an anchor strike is the single most expected fault mode, so the corridor lacked adequate anchoring protection rather than any cable being under-maintained.
Contributing factors
- ROUTE / CORRIDOR CONCENTRATION (design redundancy gap): three nominally independent systems — Seacom/Tata TGN-Eurasia, AAE-1 and EIG — share the same narrow off-Yemen corridor, so one seabed event severed all at once (Cloudflare Radar Q1-2024).
- NO ENFORCED ANCHORING-EXCLUSION / CABLE-PROTECTION ZONE in the Bab-el-Mandeb corridor — against the ICPC baseline that anchors and fishing cause ~70-80% of all cable faults, the single most expected fault mode was left unmitigated (ICPC industry baseline).
- MARITIME PROCEDURE LAPSE: a war-damaged, abandoned, not-under-command vessel was left adrift with its anchor down in a known cable corridor for days (18-26 Feb) with no timely salvage or anchor-recovery — the proximate work-procedure failure that let the anchor drag across the cables (Wikipedia 'MV Rubymar').
- REPAIR-ACCESS GOVERNANCE GAP: AAE-1 repairs stalled specifically due to 'the refusal of permits from the Yemeni Government', with no agreed safe-passage mechanism for repair ships in Houthi-contested waters, turning a routine repair into a ~4-5 month outage (Wikipedia 'AAE-1').
- ACTIVE CONFLICT / WAR-RISK ENVIRONMENT: ongoing Houthi anti-ship missile and drone threat both created the initiating strike (two missiles, 18 Feb) and blocked timely repair-ship dispatch and salvage (Wikipedia 'MV Rubymar').
- NO INSTRUMENTED FAULT FORENSICS PUBLISHED: absence of recovered anchor marks or matched fault-coordinate-versus-anchor-track survey means attribution rests on temporal/spatial coincidence only, hampering accountability and preventing a certified root cause (Wikipedia 'AAE-1' — cause 'currently unknown').
Correction of errors (COE)
- Commission a geographic route-diversity study for Europe-Asia traffic and fund at least one non-Bab-el-Mandeb path.
- Designate and enforce an anchoring-exclusion / cable-protection zone off Yemen with AIS monitoring and mariner advisories.
- Pre-position war-risk-insured repair vessels and spare cable/repeater stocks for the Red Sea region.
- Negotiate a standing permitting and safe-passage regime for repair ships in contested Yemeni waters.
- Adopt a rapid salvage / anchor-recovery protocol for disabled not-under-command vessels in cable corridors.
- Publish instrumented fault forensics (coordinates, depth, sever-vs-shunt) for major cable faults.
Lessons learnt
- A single physical hazard at a shared chokepoint can take out multiple independent backbones at once — logical diversity means little when cables are geographically co-located.
- Surface-conflict risk translates directly into subsea-infrastructure risk: an abandoned, adrift vessel with a dropped anchor is a cable-cut mechanism, not just a shipping incident.
- Restoration time, not the cut itself, drove the impact: security-constrained repair access stretched a fault into a ~5-month capacity loss.
- Impact reporting for subsea incidents is systematically weak — the headline ~25%-traffic and 'tens of millions' figures could not be tied to any named source in reachable references, so severity is easily over- or under-stated.
- Financial disclosure is opaque: only a downstream shareholder (Remgro) surfaced a hard number, and even then only an earnings delta (~R30M), never the actual repair bill.
- 'Generally accepted' is not 'verified' — absent a consortium forensic report, the exact failure geometry and the precise status of TGN-EA (distinct cable vs. shared with Seacom) remain open.
Improvements & remediation
- DesignBreak the Bab-el-Mandeb single-corridor dependency — route future Europe-Asia systems through geographically diverse paths (alternative Red Sea landings, overland/terrestrial bypasses, or non-Red-Sea routes) so no single seabed event can sever three independent systems at once (Cloudflare Radar Q1-2024).
- SafetyEstablish and enforce anchoring-exclusion / cable-protection zones over the off-Yemen corridor with AIS-based monitoring and mariner advisories, targeting the ICPC-identified dominant fault mode (anchors/fishing ~70-80% of faults) (ICPC industry baseline).
- MaintenancePre-position war-risk-insured cable-repair capacity and standing spare-cable/repeater stocks for the Red Sea region, plus routine OTDR/line-monitoring baselining, so restoration is not gated on ad-hoc mobilisation into a contested zone (Wikipedia 'AAE-1').
- ProcessNegotiate a standing permitting and safe-passage regime for cable-repair vessels in contested Yemeni waters that de-conflicts jurisdiction and secures naval escort, to prevent the multi-month permit-refusal delays seen here (Wikipedia 'AAE-1').
- ProcessInstitute rapid maritime salvage / anchor-recovery protocols for disabled, not-under-command vessels adrift in known cable corridors, so an abandoned ship's dragging anchor is arrested before it can traverse 70+ km of seabed (Wikipedia 'MV Rubymar').
- MaintenanceRequire operators to publish instrumented fault forensics (fault coordinates, depth, sever-vs-shunt) and, where safe, recover physical evidence, so future attribution rests on data rather than temporal coincidence (Wikipedia 'AAE-1').
Comprehensive analysis
Nature of the incident — mechanical severance, not a fire
This is a subsea-cable incident with no data-centre, no combustion, no fixed-facility evacuation and no electrical de-energisation in the fire sense. The fire-report schema is therefore mapped, not applied literally: 'ignition source/equipment' becomes the dragging anchor and chain of MV Rubymar; 'detection' becomes network telemetry (BGP, latency, OTDR); 'suppression' becomes traffic rerouting; 'evacuation' refers to the vessel crew; 'emergency services' becomes repair-ship dispatch. Non-applicable fire categories are flagged, not invented.
Attribution: unproven, coincidence-based
No operator or investigator published a positive, instrumented root cause. Wikipedia calls the Rubymar anchor 'One hypothesis' and states the cause is 'currently unknown'. The case rests entirely on temporal and spatial coincidence: the vessel drifted >70 km with its anchor down between 18 and 26 February, and Cloudflare dated the cuts to 24 February in the same corridor. No recovered anchor marks and no matched fault-coordinate-versus-anchor-track survey exist. The dossier states this plainly rather than asserting a proven cause.
The real systemic lesson — corridor concentration
Three nominally independent systems (Seacom/Tata TGN-Eurasia, AAE-1, EIG) share the narrow, shallow, contested Bab-el-Mandeb corridor, so a single seabed event severed all at once. There is no enforced anchoring-exclusion zone, despite the ICPC baseline that ~70-80% of cable faults come from human activity such as anchoring and fishing. The failure is design redundancy (route diversity), not cable maintenance — the cables were in normal service and failed to external impact.
Why recovery took months — geopolitics, not engineering
Restoration was gated by access, not splice time. Wikipedia records AAE-1 repairs 'pending due to the refusal of permits from the Yemeni Government', compounded by active missile/drone threat, war-risk insurance and naval-security constraints. Repairs were completed in July 2024 — roughly 4-5 months, versus days-to-weeks in a permissive environment. The absence of a standing safe-passage/permitting regime for repair ships is the governance root of the prolonged outage.
Resilience that worked — capacity headroom vs end-user impact
Despite ~25% of Europe-Asia-Middle East capacity being lost, Cloudflare states 'no loss of traffic was observed across these countries in Cloudflare Radar' (Tanzania, Kenya, Uganda, Mozambique) during 22-28 February. Rerouting onto surviving fibres, parallel systems and terrestrial paths absorbed the load. The mitigation largely worked; the residual risk analysts flag is that losing more of the same corridor simultaneously would exhaust that headroom.
Technical deep-dive
FORENSIC FRAMING (method transparency): This is a physical subsea-cable incident. There was no data-centre alarm, no fire-suppression, no fixed-facility evacuation, and no electrical de-energisation in the fire sense. Each fire-schema category below is mapped to its subsea-cable equivalent; non-applicable items are flagged, not invented. Sourcing caveat: several primary pages (HGC newsroom, Seacom, Reuters, AP, Al Jazeera, The Register, Al Arabiya, Kentik deep-dive) returned 403/404 or could not be re-fetched; findings are grounded in the pages successfully retrieved on 2026-08-02 — Wikipedia "MV Rubymar", Wikipedia "AAE-1" and the Cloudflare Radar "Q1 2024 Internet Disruption Summary" — plus citation metadata those pages expose for Kentik (31 Mar 2024) and press. The ICPC 70-80% figure is a well-established industry baseline but the exact ICPC page could not be re-fetched this pass.
DETECTION (= network telemetry / fault sensing). The cuts were detected not by any facility alarm but by out-of-band Internet telemetry: BGP routing changes, latency/traffic monitoring and cable-fault reporting by Kentik (Doug Madory), Cloudflare Radar and NetBlocks, plus operators' own line-monitoring/OTDR systems that register a fault as loss of optical continuity at a measured distance. Cloudflare Radar dated the damage to 24 Feb 2024 and named the Seacom/Tata cable, AAE-1 and EIG. Critically, for the East-African markets said to be affected (Tanzania, Kenya, Uganda, Mozambique) Cloudflare states "no loss of traffic was observed across these countries in Cloudflare Radar" during 22-28 Feb — the fault was visible on capacity/routing telemetry while end-user traffic largely stayed up.
SUPPRESSION (= fault mitigation / protection switching). No fire-suppression applies. The functional equivalent — restoring service — was automatic and manual TRAFFIC REROUTING onto surviving cables and terrestrial paths. HGC was reported to have rerouted affected traffic. Effectiveness was partial-to-good: about a quarter of Red Sea / Europe-Asia-Middle East capacity was lost, yet Cloudflare saw no material end-user loss, indicating parallel Red Sea systems and terrestrial diversity absorbed the load. The residual risk analysts flag is that losing MORE of the corridor simultaneously would exhaust that headroom.
EVACUATION (= the vessel, not the cable). All 24 Rubymar crew were evacuated by the container ship Lobivia after the 18 Feb strike. The abandonment is causally central — an unmanned, not-under-command vessel with anchor down drifted >70 km across the corridor.
EMERGENCY SERVICES (= repair-ship dispatch). Response was measured in MONTHS, not minutes, gated by war-risk and jurisdiction: Wikipedia records AAE-1 repairs "still pending due to the refusal of permits from the Yemeni Government," compounded by active missile/drone threat, war-risk insurance and naval-security constraints. AAE-1 repairs were "successfully carried out" in July 2024 — an ~4-5 month restoration versus the days-to-weeks typical of a permissive environment.
DE-ENERGISATION / ISOLATION (= wavelength/traffic isolation). Severed segments were isolated at the optical layer — affected wavelengths dropped and re-groomed onto surviving fibres and alternate cables. Subsea cables carry a repeater power feed, but no arc-flash/energised-equipment hazard was reported.
CONTAINMENT / SPREAD. Impact was contained to the three cut systems and the East-Africa/Gulf markets that lean on them; there was no cascading physical spread. The systemic "spread" concern is corridor concentration: one dragging anchor took out three independent systems at once because the Bab-el-Mandeb chokepoint carries a large share of Europe-Asia capacity.
References & provenance
- vendor-status Cloudflare Radar — Q1 2024 Internet Disruption Summary“no loss of traffic was observed across these countries in Cloudflare Radar”https://blog.cloudflare.com/q1-2024-internet-disruption-summary/
- press Wikipedia — AAE-1 (cause unconfirmed)“The cause of the damage is currently unknown, and due to the sensitivity of the location”https://en.wikipedia.org/wiki/AAE-1
- press Wikipedia — MV Rubymar (attack)“on 18 February 2024, Houthi forces launched two anti-ship missiles at the ship, one of which struck it”https://en.wikipedia.org/wiki/MV_Rubymar
- press Cloudflare — East African Internet connectivity again impacted by submarine cable cuts“the Seacom/Tata cable, the Asia Africa Europe-1 (AAE-1), and the Europe India Gateway (EIG) ... these cables remain unrepaired”https://blog.cloudflare.com/east-african-internet-connectivity-again-impacted-by-submarine-cable-cuts
- news Red Sea cable break eats away at Seacom“It's generally accepted that the Rubymar dropped an anchor when fired upon and, as a result, it damaged cables in proximity”https://techcentral.co.za/red-sea-cable-break-eats-away-at-seacom/261286/
- news Red Sea cable break eats away at Seacom (Remgro earnings disclosure)“The decrease in headline earnings relates mainly to once-off cable repair costs incurred as a result of cable breaks”https://techcentral.co.za/red-sea-cable-break-eats-away-at-seacom/261286/
- other What Caused the Red Sea Submarine Cable Cuts? (Kentik / Doug Madory)“Disruptions in East Africa, often involving the loss of Tata transit, occurred at 09:46 UTC ... that is when Seacom suffered its failure”https://www.kentik.com/blog/what-caused-the-red-sea-submarine-cable-cuts/
- news Undersea cables cut in Red Sea, disrupting internet — Houthis suspected“Undersea cables cut in Red Sea, disrupting internet ... Houthis suspected”https://www.timesofisrael.com/undersea-cables-cut-in-red-sea-disrupting-internet-in-parts-of-region-houthis-suspected/
Sourced from public post-incident reports. Quotes are short attributed excerpts for provenance only; the analysis above is original and substantially shorter than its sources. Last verified 2026-08-01.