Cyberattack on the Santos Port Authority
read more
Ransomware disrupts Santos Port Authority IT systems; port operations continue under manual contingencies amid heightened ISPS Security Level II measures
The Incident
On 6 November 2026, a power outage at the Santos Port Authority’s (APS) headquarters led to a major digital disruption in Latin America’s largest port. Upon server reboot, previously undetected foreign malware activated, causing a ransomware incident. This disabled APS’s website and key administrative systems, such as berth scheduling and billing. APS received a ransom demand by email but has not replied. The Federal Police commenced an investigation on 10 November to determine the attackers’ identities and what, if any, commercial or vessel data were stolen.
Operational Impact
Although administrative IT systems are offline, the port’s physical operations have continued unaffected. Vessel arrivals, departures, pilotage, and landside rail and road access remain operational. Most private terminals use independent IT infrastructures and report business as usual, aside from minor data-exchange delays. The federal single-window platform Porto Sem Papel (Paperless Port) and Customs systems (Siscomex) were unaffected, continuing to process ship and cargo clearances normally. Procedures directly reliant on APS, such as certain clearances, service requests, and invoicing, have reverted to manual and email-based workarounds, causing slight administrative delays.
ISPS Security Level II and Recovery Status
In response to the incident, the State Commission for Public Security in Ports (Cesportos-SP) has raised the Port of Santos to ISPS Security Level II, which will remain in force until further notice. The Port Guard has been reinforced, and calling vessels should anticipate stricter access controls and enhanced crew identification checks. Meanwhile, APS established a crisis task force and reported on 12 November that approximately 70% of server backups had been restored. Internal communications are functional, and the APS website returned online in the early hours of 13 November, with full system normalisation expected soon.
Loss Prevention Recommendations
While the ongoing disruptions are unlikely to significantly affect maritime traffic in the port, shipowners and masters with vessels calling at Santos should retain detailed logs of document exchanges with the port authority via agents to substantiate potential demurrage or detention claims. As the data breach investigation is ongoing, masters, agents, and accounting teams should also guard against phishing emails or altered payment instructions purporting to originate from the port authority. Finally, vessels must ensure compliance with ISPS Level II requirements prior to arrival, briefing crews on stricter gangway and shore-leave checks. Members requiring local assistance or further updates are invited to o contact our Santos Office.
Related Topics:
