On 22 July 2021,

Transnet Transnet SOC Ltd is a large South African rail, port and pipeline company, headquartered in the Carlton Centre in Johannesburg. It was formed as a limited company on 1 April 1990. A majority of the company's stock is owned by the Department ...

became a victim of a

ransomware Ransomware is a type of malware that Encryption, encrypts the victim's personal data until a ransom is paid. Difficult-to-trace Digital currency, digital currencies such as paysafecard or Bitcoin and other cryptocurrency, cryptocurrencies are com ...

attack. The attack caused Transnet to declare

force majeure In contract law, force majeure ( ; ) is a common clause in contracts which essentially frees both parties from liability or obligation when an extraordinary event or circumstance beyond the control of the parties, such as a war, strike, riot, ...

at several key container terminals, including

Port of Durban The Port of Durban, commonly called Durban Harbour, is the largest and busiest shipping terminal in sub-Saharan Africa. It handles up to 31.4 million tons of cargo each year. It is the fourth largest container terminal in the Southern Hemisphe ...

, Ngqura,

Port Elizabeth Gqeberha ( , ), formerly named Port Elizabeth, and colloquially referred to as P.E., is a major seaport and the most populous city in the Eastern Cape province of South Africa. It is the seat of the Nelson Mandela Bay Metropolitan Municipal ...

and

Cape Town Cape Town is the legislature, legislative capital city, capital of South Africa. It is the country's oldest city and the seat of the Parliament of South Africa. Cape Town is the country's List of municipalities in South Africa, second-largest ...

. The attack was the first time that the "operational integrity of the country's critical maritime infrastructure has suffered a severe disruption" leading the

Institute for Security Studies The Institute for Security Studies, also known as ISS or ISS Africa (to distinguish itself from other similarly named institutes in other parts of the world), described itself as follows: "an African organisation which aims to enhance human se ...

(ISS) to call its impact "unprecedented" in South African history. The ISS speculated that Transnet was withholding details about the attack as it was an issue of national security and because the attack might cause legal liabilities for the company.

Bloomberg News Bloomberg News (originally Bloomberg Business News) is an international news agency headquartered in New York City and a division of Bloomberg L.P. Content produced by Bloomberg News is disseminated through Bloomberg Terminals, Bloomberg T ...

stated that the attackers encrypted files on Transnet's computer systems thereby preventing the company from accessing their own information whilst leaving instructions on how to start ransom negotiations. The Bloomberg article quotes a source from the cybersecurity firm Crowdstrike Holdings Inc. which states that the ransomware used in the attack was linked to "strains known variously as “Death Kitty,” “Hello Kitty” and “Five Hands.”" and likely originated from Russia or Eastern Europe. The Department of Public Enterprises stated that none of Transnet client's data had been compromised in the attack. The timing of the attack, which followed closely after the 2021 South African unrest following former South African President Jacob Zuma's imprisonment, caused speculation that the two events might have been part of a coordinated effort to disrupt economic activity in the country. The authorities stated that the two events were likely unrelated.

Background

The Durban port handles 60% of South African container traffic.

Timeline

* July 22, Transnet ransomware attack occurred. *July 26, most computer systems had been restored. * July 27, Transnet's investigation into the attack's severity was still ongoing. * July 28, Department of Public Enterprises stated that Transnet had fully restored operations at the ports.

References

Cyberattacks Hacking in the 2020s July 2021 in Africa 2021 in South Africa Cybercrime in South Africa 2021 crimes in South Africa July 2021 in South Africa {{SouthAfrica-hist-stub