Cyber Incident Victim: DP World Australia
Date:
Nov 2023
Location:
Australia
Summary
A cybersecurity incident at a major Australian port operator managing terminals in Fremantle and other cities forced nationwide port closures, disrupting import/export operations. The Australian Federal Police launched an investigation while government crisis protocols were activated; landside access remained restricted for days, though ship movements continued unaffected at Fremantle. Technical assistance was provided by national cybersecurity agencies as the operator worked to contain the breach and assess system impacts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 10, 2023, DP World Australia detected a cybersecurity incident affecting its container terminals in Sydney, Melbourne, Brisbane, and Fremantle, leading to the immediate closure of landside operations at these ports that evening. The company restricted truck access to its facilities to contain the breach while initiating an internal investigation, though ship movements and crane operations continued unaffected. The Australian Federal Police launched an investigation into the incident, and the Australian Signals Directorate’s Cyber Security Centre provided technical assistance. By November 11, the Australian government activated the National Coordination Mechanism (NCM)—a crisis management framework previously used during the COVID-19 pandemic and Medibank data breach—to coordinate federal, state, and industry responses. National Cyber Security Coordinator Air Marshal Darren Goldiem warned the disruption would likely persist for several days, impacting the national movement of goods.
Fremantle Ports clarified that only DP World’s landside operations were compromised, with Patrick Terminals operating normally, though truck movements in and out of DP World’s laydown area remained restricted. Home Affairs Minister Clare O’Neil confirmed regular government briefings and collaboration with DP World to assess the incident’s scope. The NCM convened its first meeting on November 11 and scheduled a follow-up session for November 12. DP World issued a statement emphasizing efforts to safeguard employee and customer data while investigating potential system and data impacts. Cybersecurity expert Nigel Phair speculated the incident likely involved a ransom demand, suggesting prolonged disruptions if unresolved. The incident marked the NCM’s continued role in addressing non-health crises, including prior supply chain and cyber emergencies.