Off the grid: Port cyber attack already hurting business

The economic impact of the DP World cyber attack is set to deepen with disruptions including cancellation of export shipments likely for several weeks at Australian ports.

The economic impact of the DP World cyber attack is set to deepen with disruptions including cancellation of export shipments likely for several weeks at Australian ports.

Global freight giant DSV has told customers that the cyber attack combined with industrial action would exacerbate efforts to return operations to normal at DP World’s terminals in Brisbane, Melbourne, Perth and Sydney

“The interruption to several maritime port facilities is likely to continue for a number of days,” according to an email DSV sent to customers on Monday. “All slots were cancelled on the weekend for goods moving in and out of the country. Delays in container availability will continue for several weeks due to both the industrial action and IT system outage.”

DP World executive vice president Nicolaj Noes conceded that the total economic impact of attack was “significant” and could have stopped some businesses operating.

DSV said at Melbourne the terminal was open for import deliveries only and no export slots were available while in Sydney the terminal was open for imports only.

Another logistics company Mainfreight has told clients to expect delays in import container deliveries due to backlogs while export shipments may experience delays or cancellations.

“Recent system testing by DP World showed partial success, allowing for some import flow today, with a priority on containers with the longest dwell times (meaning containers sitting the longest),” Mainfreight said. “In Melbourne, it is advisable to refrain from delivering exports today (Monday).”

A gantry crane adorned with a logo for ports operator DP World is seen behind company signage at an entrance to the Port Botany compound in Sydney.

DP World executive vice president Nicolaj Noes on Monday said the shutdown of the company’s local network has managed to reduce any threat from expanding to partners and other parts of the global business. Mr Noes, speaking on ABC’s afternoon briefing, said DP World first noticed some “unusual activity” on Friday and the company moved quickly to shut down its systems while it investigated.

“This all started on Friday when we detected unusual activity inside our operation and we immediately decided to shut down all connections with the outside in our own systems to protect the data integrity that we have,” he said.

Mr Noes also denied speculation that DP World had been sent a ransom demand, telling ABC News: “No, we haven’t heard from the third party who has done this.”

Asked about the total economic impact of the situation, Mr Noes acknowledged that it was “significant” and missed freight could have stopped some businesses from being able to operate on Monday. “To give some context, it’s about 30,000 containers that had been standing still over the weekend that haven’t moved and are now starting to move,” he said. “We can probably handle about 5000 containers per day so it will take us a little while to clear the backlog and get fully back to work.”

The cyberattack on DP World Australia, one of Australia’s biggest port operators, is already reaching through the Australian economy to manufacturers such as Lindsay Wakefield.

The managing director of Safetech said that at least two shipping containers of machinery had been held up destined for his Latrobe Valley factory, which makes hoists and lifts for the logistics and warehouse industry.

“This includes both components and finished goods,” said Mr Wakefield. “We are still establishing what other orders may be impacted. This stops some manufacturing and will slow our deliveries to several building sites. Hopefully, the customers will be understanding and not impose penalties.”

Safetech managing director Lindsay Wakefield: ‘This stops some manufacturing and will slow our deliveries to several building sites.’

Mr Wakefield said the company would have to reschedule jobs and reallocate staff who were committed to scheduled work. “If it is resolved in a few days it will not be too dramatic but past that and it becomes significant and will have consequences for deliveries over several months,” he said.

DP World Australia says its investigation and ongoing remediation work were likely to continue for some time and it is continuing to work closely with the National Cyber Security Coordinator, the Australian Cyber Security Centre and Australian Federal Police.

International Forwarders and Customs chief executive Scott Carson said DP World handled about 10,000 containers a day at its terminals in Brisbane, Melbourne, Sydney and Fremantle and any stoppage would take time to clear.

“They generally work 24/7 and they can throw a lot of equipment at a backlog,” Mr Carson said. “I would hope that in a couple of days what we call the receivables and deliveries (R & D) would be back to normal meaning the backlog on the dock pad would be cleared.”

He said one problem could be the current industrial dispute between the company and the Maritim Union that could reduce the amount of workers rostered to clear the backlog. The Australian understands that the industrial action could cause DP World to lose one day’s worth of freight movement every three days. Under the protected industrial action, there are stoppages in place around 2pm each day, with DP World’s ability to move containers dropping by one third. On a regular day the company can move 6000 containers across its four ports but under the industrial action and navigating stoppages and employees walking out, that figure drops to 4000 containers per day.

Australian Federal Police are investigating the cyber security breach on the port operator which manages container terminals in Sydney, Melbourne, Brisbane and Freemantle.

Dubai-based DP World has been criticised for poor communication in the aftermath of the cyberattack after failing to notify the Freight Trade Alliance that operations had resumed, a move that left transport operators scrambling to pick up goods. There are now fears the disruption could delay the delivery of goods locally and internationally for up to a week, with as many as 30,000 shipping containers left stranded over the weekend.

FT Alliance said it only learned some port operations were resuming through local terminal offices and its members, director Paul Zalai said.

“There was no ability to prepare for resumption this morning, so transport operators will be scrambling now to get their schedules to get into terminals and start taking containers out,” he said Monday. “We have been critical of DP World in regard to the level of information they’ve been sharing.”

National Cyber Security Coordinator Darren Goldie confirmed over the weekend that DP World had the ability to move sensitive freight through its ports despite the shutdown.

Mr Goldie, who convened the National Coordination Mechanism at least twice over the weekend, also confirmed Australian Federal Police were investigating the breach.

Cyber Security Minister Clare O’Neil has described the incident as serious, noting it affects about 40 per cent of goods being imported and exported in Australia.

“This incident is a reminder of the serious risk that cyber attacks pose to our country, and to vital infrastructure we all rely on,” she said.