Cyber-Attack on Port Operator Transnet Cripples Operations at South African PortsEverstream Team
On July 22, South Africa’s largest port operator Transnet Port Terminals (TPT) suffered a cyber-attack that severely affected already-weakened supply chains relying on South African ports to import, transship, or export goods following a recent outbreak of violence and civil unrest earlier in the month.
As IT systems used to track containers, book pick-up and delivery appointments, or communicate with shippers went offline following the attack, significant delays in the movement of goods were reported at terminals across the country’s largest ports, including Durban, Coega/Port Elizabeth/Nqura, and Cape Town.
Due to the length of the outage, TPT was forced to declare force majeure, a legal clause that releases the operator from its contractual obligations due to an unforeseen event. While container tracking services resumed on July 28, TPT lifted the force majeure only on August 2. However, the major backlog of containers resulting from the week-long disruption will likely take several weeks to clear, impacting cargo flows at sub-Saharan Africa’s busiest maritime hub potentially until the end of the third quarter.
Cyber-attack further disrupts supply chains strained from recent civil unrest
Transnet SOC Limited is a state-owned enterprise that runs South Africa’s largest ports, railway networks, and pipeline operations including terminals in Durban, Coega/Port Elizabeth/Nqura, and Cape Town. The company relies on its Navis N4 and Camco systems to manage container flows at port facilities, most notably at the Port of Durban which handles 60 percent of the nation’s maritime cargo. The cyber-attack came less than a week after violent acts of civil unrest, which started on July 9 in parts of South Africa, were brought under control and exposed the physical vulnerabilities of Transnet’s operations to supply chain disruptions.
In particular, the Port of Durban and Richards Bay experienced lengthy delays during the civil unrest in cargo processing due to road blockages, industrial looting, vandalism, as well as the subsequent deployment of military forces in response.
Just as intermodal cargo flows began to recover from the civil unrest, company officials reported on July 22 that Transnet was hit by a coordinated ransomware attack from an unknown source, causing the Navis and Camco systems to go offline. The attack immediately affected port operations, as TPT uses the Navis N4 system across all facilities, with authorities unable to trace containers in the terminals and trucking companies not able to book appointments for pick-up and delivery. To mitigate some of the worst effects, the port operator reverted to a manual-entry system to track containers.
As port workers struggled to physically locate cargo, the growing backlog of containers forced the company to declare force majeure on all maritime and rail shipments dating back to July 22. Both IT systems finally came back online on July 28.
Container lines revise vessel schedules as congestion increases
Following the cyber-attack, all TPT-operated ports experienced significant disruption, with the Port of Durban bearing the brunt of the impact. Vessels were unable to berth and unload at originally scheduled times, while cargo trains remained in the terminals. Within a few days after the cyber-attack, congestion issues began to worsen at South Africa’s main ports, with waiting times up to 5 days reported in Cape Town, up to 3 days in Port Elizabeth, and up to 3 days in Durban.
Despite the progress in bringing the operations back online, some carriers have decided to divert ships to other ports. Major shipping line Maersk informed their customers that a number of their ships omitted severely affected ports and were diverted to the Port of Maputo in Mozambique to load and unload cargo.
|Port||Terminal||Average waiting times|
|Cape Town||Cape Town Container Terminal (CTC)||3 – 5 days|
|Multi-purpose Terminal (MPT)||3 days|
|Durban||Durban Container Terminal (DCT)||3 days|
|Pier 1 Container Terminal||1 – 2 days|
|Multi-purpose Terminal (MPT)||2 – 3 days|
|Coega/ Port Elizabeth/Nqura||Port Elizabeth Container Terminal (PECT)||1 – 2 days|
|Nqura Container Terminal (NCT)||2 – 3 days|
Automotive, raw materials, and agricultural industries hit hardest
Disrupted container operations have had significant impacts on some of South Africa’s key industries, including automotive, raw materials, and agriculture. While containers loaded with critical car components reportedly remained stuck at port yards during the attack, raw material producers, including ferromanganese manufacturer Assmang, were forced to declare force majeure after operations were brought to halt on July 12-13 amid unrest at the Cato Ridge Works and Cato Ridge Alloys in South Africa’s KwaZulu-Natal Province. The company reported expected delays in shipments of up to 3 weeks. These delays are likely to be exacerbated by the logistics challenges following the cyber-attack on TPT.
In addition, delays and congestion issues at the Port of Durban have also reached the agriculture and food processing industries. South African meat trade groups SAMPA/Amie SA reported that 290 reefer containers remained blocked at the facilities, increasing the risk of shortages of reefer plugs if backlogs are not cleared quickly enough. With South Africa being the second largest citrus exporter in the world, agricultural firms started to divert shipments to the Port of Maputo to prevent the total loss of fresh produce, likely adding to delays. Other agricultural exporters may enact similar contingencies given the number of backlogs at TPT terminals as intermodal transit resumes full operations under tight capacity.
Congestion and delays could last well into September
With TPT lifting the force majeure on August 2, the situation is likely to improve over the coming days as the company starts to clear congested hubs across modalities. However, cargo operations are likely to sustain significant delays over the next 3-4 weeks due to a number of reasons: ports in South Africa may experience a concentrated arrival of vessels that could further slow-down operations; a surge of export shipments that were held back during the unrest and cyber-attack could start to arrive at South African terminals; and it may take more time for shippers to export cargo from the Port of Maputo as the port has fewer vessel calls, or to arrange onward shipping for inbound cargo to South Africa.
Highlighting the significant delays that supply chain operations are likely to experience in the coming weeks, ground operators at the Port of Durban reported excessive truck turn-around times of more than 14 hours on July 29 as the port gradually resumed digital operations.
Organizations with supply chain operations in South Africa are advised to use Everstream Analytics’ near-real time intelligence monitoring capabilities to stay abreast of congestion updates and other issues that may affect port operations in the country. Customers can also use Everstream’s Transport Execution solutions to acquire real-time visibility on how their container movements may be affected due to the cyber-attack on TPT.