Port of Santos continues to experience system instability following cyberattack and digital collapse

The main services provided to operators and users of the Santos waterfront remained unavailable through their traditional platforms (Sílvio Luiz/AT)

The effects of the cyberattack on the systems of the Santos Port Authority (APS), which occurred last Friday, continued to disrupt the administrative and operational routine of the Port of Santos this Thursday (12). APS announced that its institutional website would become partially available again and that the page had been “republished”. However, A Tribuna found that the portal remained unstable.

When asked about the access difficulties, the port authority explained that some people might be unable to access the website because its IP (Internet Protocol) address had changed. This is the numerical address that identifies and locates each server connected to the worldwide computer network.

The main services provided to operators and users of the Santos waterfront remained unavailable through their traditional platforms and continued to be delivered through alternative means, via requests submitted by email and other contingency channels. The port authority emphasized that it was continuing the gradual recovery of its affected online systems, but assured that port operations were proceeding “with no risk of shutdown, maintaining regular vessel arrivals and departures, as well as land access”.

Collapse The cyber incident plunged the largest port in the Southern Hemisphere into an unprecedented digital crisis. The complete shutdown of APS servers compromised identification records and left access points vulnerable, forcing the replacement of automated procedures, such as cross-checking data on berth and vessel dimensions, with manual and visual inspections. This resulted in slower operations and longer waiting times for the berthing and departure of ships, trucks and trains.

At the height of the outage, approximately 80% of APS administrative staff had to work remotely, returning to their offices only last Tuesday, one day after internet and telephone services were restored at the headquarters.

Ransom According to information obtained by A Tribuna , the hackers did not demand a specific ransom amount. The newspaper learned that the criminals contacted APS Information Technology (IT) professionals through an encrypted and untraceable system, warning that if the state-owned company wanted to recover its data, it would have to enter into negotiations.

The Port Authority did not respond to the attackers' approach and is focusing its efforts on independently restoring its digital environment, mobilizing its own IT team, outsourced companies and Federal Government specialists — including technicians from the Federal Data Processing Service (Serpro), to which backups from the state-owned company's own data center were sent for forensic analysis.

Meanwhile, the Federal Police (PF) opened an investigation on Tuesday to determine the causes of the collapse and identify those responsible for the attack, while the State Commission for Public Security at Ports, Terminals and Navigable Waterways (Cesportos-SP) raised the security level of the port complex to Level 2 (elevated). This allows for increased deployment of the Port Guard (GPort) and intensified Military Police patrols at access gates.

To coordinate response efforts and ensure business continuity, APS also established a temporary crisis management office on Tuesday, retroactively effective as of Saturday. The initiative is being operated by the Response and Recovery Group (GRR) and brings together specialists from various technical and administrative fields. Meanwhile, the federal Porto Sem Papel system continues to assist with the alternative exchange of documents at the port.

Crimes Criminal defense attorney Leonardo Magalhães Avelar said the cyberattack on the Port of Santos highlights a growing concern. “Criminal organizations made up of hackers have begun targeting strategic infrastructure, whose disruption can have major economic consequences”.

From a criminal law perspective, the attorney explains that the investigation must identify not only those responsible for the intrusion but also its purpose, “which may involve the commission of crimes related to extortion, unauthorized access to information and system sabotage”. According to Avelar, protecting such infrastructure is no longer merely a matter of technological security but has become “a public and national security challenge”.