The Port of Santos has confirmed that a cyberattack took its computer systems offline, leaving the website and internal systems of Latin America’s largest port still unavailable on Wednesday 11 November. Cargo handling has continued throughout the incident, but staff have been forced to fall back on manual procedures while technical teams work to restore the affected systems.

The Santos Port Authority, known as APS, confirmed the attack to Brazilian media on 10 November. It said it had not yet been possible to determine the full scope of the incident or whether any data was accessed.

What happened at the port

The disruption began on the morning of Friday 6 November, when a power outage affected the port authority’s servers. CNN Brasil reported that a malicious program was already present on the authority’s network before the outage and was activated after the electricity supply was interrupted.

The failure took down the port’s public website, its internal intranet and the digital services used by customers and other port users. Internet and telephone services were restored on Monday 9 November after a three-day outage, but the website and internal systems remained offline on 11 November, with restoration work continuing gradually.

Brazil’s Federal Data Processing Service, Serpro, was called in to help investigate the incident and restore services. System backups were also submitted for forensic examination. Around 80 per cent of the port authority’s administrative employees were working remotely because of the difficulties at its headquarters, according to the Brazilian newspaper A Tribuna.

Cargo keeps moving, but paperwork slows

Despite the digital disruption, the port authority said vessel arrivals and departures and landside access to the port remained operational, and that no shutdown of cargo operations was expected. Terminal operators, including Santos Brasil and Brasil Terminal Portuário, reported no operational impact, saying their own independent systems remained fully functional.

Even so, the loss of automated systems has slowed some procedures. Tasks that would normally be handled digitally, such as checks on whether a vessel’s dimensions are compatible with an available berth, have had to be carried out by hand. To keep documentation moving, the authority routed clearance work through the federal Porto Sem Papel paperless system, which was not affected by the attack.

The authority said contingency procedures were in place, its Port Guard teams had been reinforced, and no services had been suspended, although it acknowledged that delays could occur.

Security raised as police investigate

On Sunday 8 November, the São Paulo state commission for port security, Cesportos-SP, raised the port complex’s security level to Level II, the middle step on a three-level scale, in response to the problems with access control systems. The move allows for an increased police presence in the port area, including support from the Military Police.

Brazil’s Federal Police opened an inquest on 10 November to establish how the attack happened. A Tribuna reported that suspected hackers had demanded payment to restore the systems, but the authorities have not confirmed any ransom demand, and it remains unclear whether the intruders were external attackers or opportunists exploiting the instability caused by the power failure.

The incident is a reminder of how exposed major trade gateways have become to digital disruption. For now, the port’s priority is restoring its systems and establishing whether any sensitive logistical or operational data was taken — a question the authority says it still cannot answer.