Cyberattack Strikes Latin America's Largest Port Without Halting Critical Trade

2026-11-11 global

Santos, Wednesday, 11 November 2026.
Despite suffering an encrypted cyberattack that forced manual procedures, Latin America’s largest port kept essential trade moving, highlighting rising digital vulnerabilities across key global shipping hubs.

A Cyberattack of Uncertain Origin

Latin America’s largest port, the Port of Santos in São Paulo state, confirmed on 10 November 2026 that its digital infrastructure had been compromised by an encrypted cyberattack [1][4][6]. Authorities reported that the invasive code, which became active after a power outage on 6 November 2026, disabled the port’s public-facing website, internal intranet, and client-facing systems, forcing staff to rely on manual backups and alternative data-exchange channels [1][3][4][6]. While the exact entry vector remains under investigation, the Federal Police opened an inquest on 10 November 2026 to determine whether the attack originated from external threat actors or was an opportunistic exploitation of the outage [4][6].

Operational Continuity Despite Digital Disruption

Despite the digital paralysis, the Port of Santos’ core cargo-handling operations remained fully operational throughout the crisis [1][2][3][4][6][8]. The Autoridade Portuária de Santos (APS) emphasized that vessel arrivals, departures, and overland access routes continued without interruption, while biometric checkpoint systems were temporarily suspended before being reactivated on 9 November 2026 [1][3][6]. To maintain administrative workflows, APS invoked contingency protocols, routing documentation through the federal ‘Porto Sem Papel’ system—a paperless clearance platform that was unaffected by the attack [1][3][6][8]. Terminal operators such as Santos Brasil and Brasil Terminal Portuário reported no operational impact, noting that their independent systems remained fully functional [4][6].

Heightened Security Measures and Data Uncertainty

On 8 November 2026, the Comissão Estadual de Segurança Pública nos Portos, Terminais e Vias Navegáveis (Cesportos-SP) elevated the port’s security level to Level II in response to the system instabilities, mandating stricter vehicle and personnel screening protocols [1][3][6][8]. While APS confirmed that cargo integrity was preserved, the agency stated it could not yet determine whether sensitive logistical or operational data had been accessed or exfiltrated during the incident [1][3][4][6]. Internet and telephony services were restored on 9 November 2026 after a three-day outage, yet the port’s website and internal systems remained offline as of 11 November 2026, with gradual restoration underway [1][2][3][4][6][8].

Broader Implications for Global Trade Resilience

The Port of Santos attack underscores a growing vulnerability within critical maritime infrastructure, where ransomware and data-encrypting campaigns have surged by 67% between April and September 2026 compared to the same period in 2025 [4][GPT]. Industry analysts warn that the asymmetry between attack and defense timelines—where vulnerabilities are exploited within 24 hours while patches take an average of 55 days—creates untenable risks for essential services [4]. Security researchers have linked similar campaigns targeting the maritime sector to advanced persistent threat groups, including one that issued ransom demands against 38 transport companies on the dark web in October 2026 [4][GPT]. While Brazilian authorities have urged calm, the incident serves as a stark reminder that even non-coordinated cyber intrusions can disrupt the $46 billion annual flow of Brazilian soybeans, coffee, and sugar through the Port of Santos alone [3][GPT].

Sources

Maritime Logistics Cyberattack