Digital collapse following hacker attack prompts Port of Santos to establish crisis management office

According to the Santos Port Authority, vessel arrivals and departures have been proceeding normally (Vanessa Rodrigues/AT/Archive)

The Santos Port Authority (APS) has established a temporary crisis management office to respond to the hacker attack and digital blackout affecting the Port of Santos since last Friday. The administrative order was issued on Tuesday, with retroactive effect from Saturday, the day after the incident. Online systems and services are being gradually restored.

According to the administrative order, the crisis management office will operate through the Response and Recovery Group (GRR), which is responsible for planning, coordinating, monitoring and carrying out the actions required to respond to the incident and ensure the continuity of the company's activities.

The group will bring together professionals from the following areas: information technology; governance, risk and compliance; legal affairs; administration and finance; port operations; the Cyber Incident Prevention, Handling and Response Team; security unit planning; information security; and personal data processing.

In a statement, APS said it “is continuing to restore its online systems, which were affected on Friday by a cyberattack following the systems' reboot after a power outage”.

“System recovery is being carried out gradually. APS has already restored internet and telephone services, which were back online on Monday. The Port's website and other internal systems will be made available shortly. Port operations are continuing, and there is no risk of a shutdown. Vessel arrivals and departures, as well as land access to the Port, remain unaffected”, the port authority said.

The operator of the largest port in the Southern Hemisphere also stated that “it was not possible to determine the extent of the attack or whether any data had been accessed” and that “some services are being provided through alternative means”.

However, APS assured that no services had been discontinued, as it had “promptly adopted all technical, administrative and legal measures to mitigate potential impacts and intends to normalize all systems and services shortly”.

Federal Police investigate The Federal Police (PF) opened an investigation on Tuesday to look into the case and stated at the time that it was not possible to “establish the causes of the reported failures or confirm whether a hacker attack had occurred”.

According to the agency, “only after the investigative procedures have been properly carried out and the collected evidence has undergone technical analysis will it be possible to clarify the facts and determine what actually happened”. Contacted this Wednesday (11), the PF said it had no new information regarding the incident.

No one is immune No institution is completely immune to cyberattacks, even when it invests in technology and security. This is the warning issued by technology experts interviewed by A Tribuna . In their view, strategies should prioritize prevention, rapid threat detection and operational continuity.

Cybersecurity expert and CEO of TI Safe, Marcelo Branquinho, stated that “there is no 100% protection against cyberattacks”. “Any institution that relies on digital systems faces some level of risk, even when it invests heavily in security”. According to him, ports and banks, for example, are exposed because of the complexity of their systems, connections with suppliers, legacy technologies and security vulnerabilities.

Branquinho emphasized that, in addition to prevention, critical infrastructure must be prepared to keep services running during a crisis. Recommended measures include isolated and tested backups, network segmentation, continuous monitoring, staff training and incident response plans.

CTC Technical Manager Marcelo Silva reinforced that absolute protection does not exist. “Every connected system has people using it, suppliers accessing it and software with vulnerabilities that have not even been discovered yet. There will always be some level of risk”.

However, the expert pointed out that “the more realistic goal is different: make it as difficult as possible for intruders to gain access, detect quickly when someone gets in and be able to resume operations within a short period”.

Silva compared cybersecurity to home security. “No lock can stop a determined burglar from breaking in, but with a good lock, an alarm, a camera and insurance, the chances of them choosing your home drop significantly, and if it does happen, the damage is smaller. The case in Santos illustrates this. The attack happened, but there was a Plan B, and operations continued”.

He advocates frequent testing of recovery plans and backups. “Security is not a project with a beginning, middle and end. It is an ongoing routine, just like maintaining a ship. You don't do it once and then forget about it”.