Six cases worth knowing
Logistics adds a motive absent elsewhere: terminal systems are sometimes targeted by organised crime that does not want to destroy them, but to quietly change a single record inside them.
Antwerp, 2011 to 2013
When the goal is not destruction but one record
A smuggling network gained access to the systems of terminal companies in the port of Antwerp in order to intercept container release codes and collect, with their own transport, containers belonging to unsuspecting customers before the rightful consignee arrived. Entry came in two stages: it began with malware sent to employees, and when the intrusion was detected and the network protected with a firewall, the perpetrators switched to physical means — installing keyloggers on keyboards and their own devices hidden in disk enclosures and power strips. In June 2013 police searched more than twenty locations and detained fifteen people, including two IT specialists. Here nobody halts the terminal or demands a ransom. The facility operates normally, and the only trace is a container released on a valid code to the wrong person.
DP World Australia, November 2023
Three days and thirty thousand containers
On 10 November 2023 the operator disconnected four container terminals — in Melbourne, Sydney, Brisbane and Fremantle — from the internet to halt an ongoing attack. The terminals stopped releasing and receiving cargo, and around thirty thousand containers were stranded in the yards. The operator handles close to 40 percent of Australia's freight movements. On resuming work on 13 November, the expectation was to move around five thousand containers, less than a quarter of normal daily volume. This is the right measure of risk for a terminal: not the cost of restoring the system, but the cost of the queue forming at the gate and spreading through the whole chain.
Maersk and NotPetya, June 2017
And the question of whether manual working is possible
On 27 June 2017 malware spread through an infected update to accounting software and paralysed a global carrier along with its terminal company. Disruption affected terminals on several continents, including Rotterdam, Los Angeles, New York, Barcelona, Algeciras and Mumbai. The company valued the impact at 200 to 300 million dollars. Recovery involved reinstalling around 45 thousand computers, 4 thousand servers and 2.5 thousand applications, completed in ten days rather than the estimated six months. Through that period the company handled around 80 percent of normal volume, working manually.
Nagoya and Expeditors
Two invoices for the same kind of downtime
On 4 July 2023 a ransomware attack halted Japan's largest container terminal in the port of Nagoya. Loading and unloading stopped, and the terminal resumed work on the afternoon of 6 July, after roughly two days. The effect passed immediately to an automotive manufacturer, which suspended its export component packing line. In February 2022 the global forwarder Expeditors International shut down most systems after an attack and operated in reduced mode for close to three weeks. The company valued the event at around 60 million dollars, of which 40 million was lost freight capacity and cargo detention charges, and 20 million the cost of investigation and environment recovery. Restoring the IT is the smaller part of the loss. The larger part is what did not move in the meantime.
Blue Yonder and Kojima
You are a link in someone else's chain
On 21 November 2024 an attack struck a supply chain management software vendor. The vendor itself runs no warehouse, but its customers do: retail chains lost the management system for fresh food warehousing, and a restaurant chain lost its staff scheduling system. In February 2022 an attack on a single parts supplier, Kojima Industries, halted fourteen Toyota plants and twenty-eight production lines for a day — Toyota itself was not attacked. The lesson runs both ways: an incident at your system vendor, service company or connectivity provider reaches your facility, and you stand in exactly the same relation to your own customers.
Handling equipment and the vendor channel
A risk that requires no attacker
In February 2022 an attack on a European terminal group affected its facilities in Belgium, the Netherlands and Germany, among them a terminal in the Northern Port of Gdańsk. The terminal kept working, but the event shows that belonging to an international group also means a shared attack surface. A separate thread concerns the equipment itself: the United States Coast Guard issued warnings in 2023 and December 2024 regarding Chinese-built ship-to-shore cranes, and congressional committees concluded an inquiry into the matter in March 2024. Among the findings was the presence in cranes of cellular modems that port operators had not ordered and that were not needed for the equipment to work. To be fair: what was described was risk and unexplained connectivity, not a confirmed attack.
All the events cited come from publicly available sources: CERT Polska (NASK) reports, company statements and annual reports, regulatory decisions, security researchers' publications and press coverage. This material is informational and does not constitute legal advice.