Cyber Incident Victim: DP World
Date:
Nov 2023
Location:
Australia
Summary
A cybersecurity incident disrupted operations at major Australian ports managed by DP World, prompting closures expected to last multiple days and impacting national import/export activities. The Australian Federal Police launched an investigation while the government activated its National Coordination Mechanism—previously used during COVID-19 and major cyber incidents—to coordinate response efforts across agencies and industry stakeholders. Landside operations, including truck access to container terminals, were restricted as the company contained the breach, though ship movements remained unaffected. Technical assistance was provided by the Australian Cyber Security Centre, with ongoing assessments to determine the full scope of system and data impacts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 10, 2023, DP World Australia detected a cybersecurity incident affecting its container terminal operations in Sydney, Melbourne, Brisbane, and Fremantle. The company restricted landside access to its Australian ports that same night, halting truck movements in and out of its facilities while ship loading/unloading operations continued. The Australian Federal Police initiated an investigation, and the Australian Signals Directorate’s Cyber Security Centre provided technical assistance. Home Affairs Minister Clare O’Neil activated the National Coordination Mechanism (NCM) at noon on November 11, engaging federal, state, and industry stakeholders under the national crisis management framework previously used during COVID-19 and the 2022 Medibank breach. National Cyber Security Coordinator Darren Goldiem warned the disruption would persist for multiple days, impacting national import/export logistics.
DP World maintained restricted landside operations through November 11 while investigating the incident’s scope and securing its networks. Fremantle Ports clarified that only DP World’s truck access was impaired, with Patrick terminals and ship movements unaffected. The NCM convened its first meeting on November 11 to assess operational impacts, with a follow-up session scheduled for November 12. No data compromise or attacker identity was disclosed. Industry analysts, including UNSW’s Nigel Phair, publicly speculated about potential ransom demands and multi-week recovery timelines, though these assessments were not corroborated by official sources. The incident marked the NCM’s sixth activation for cybersecurity emergencies since its 2018 establishment.