Adriatic Port Authority

Summary

In June 2026, the Adriatic Port Authority was hit by a ransomware attack attributed to Anubis. Cargo-scheduling and clearance software went down, halting vessel unloading and shutting local intermodal connections for days.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In June 2026, the Adriatic Port Authority suffered a ransomware attack that froze its terminal operating systems, according to Ti Insight’s Global Supply Chain Risk Monitor. The affected software was used to schedule and clear cargo movement. Its failure halted vessel unloading across the region. The attack also shut down local intermodal connections for several days. The cybercriminal group Anubis was identified as the attacker responsible.

The Adriatic Port Authority incident formed part of a wider series of attacks on software used at ports during summer 2026. The source describes the Adriatic disruption as following a coordinated breach in the United States in mid-June. That U.S. incident hit digital systems supporting freight management and logistics providers at major American port gateways. Cargo-tracking platforms, terminal-scheduling systems, and internal data nodes were compromised at more than 200 logistics and transport entities. As terminal operators in the U.S. event were locked out of automated systems, they returned to phone calls and paper manifests to keep containers moving. The resulting gridlock produced an estimated $380 million in delays and backlogs across the Americas, according to Zamak Technologies. The article presents the U.S. breach and the Adriatic ransomware attack as related chronologically within a broader wave of port-sector cyber incidents, but it does not state that they involved the same attacker, shared infrastructure, or were otherwise directly linked.

Operational continuity during the U.S. breach depended on manual processes after automated access was lost. Phone calls replaced some system-based coordination, and paper manifests were used to continue handling containers. The source does not identify an equivalent workaround for the Adriatic Port Authority or provide a day-by-day account of its response. For the Adriatic event, it establishes that the terminal operating systems froze, cargo-scheduling and clearance functions stopped operating, vessel unloading was halted across the region, and local intermodal connections remained down for several days.

In a July 2026 retrospective directive, the Cybersecurity and Infrastructure Security Agency traced the U.S. breach to unpatched legacy software and missing multi-factor authentication. The source does not explicitly assign those same root causes to the Adriatic Port Authority attack. It also does not describe the initial access method, how the ransomware was detected, the ransom demand, containment steps, data theft, or the restoration timetable for the affected systems. The confirmed consequences recorded for the Adriatic authority were a multi-day interruption of terminal operations and intermodal connections, together with a regional halt in vessel unloading caused by the failure of the software used to schedule and clear cargo movement.

Sources

Sources available to members: 1 source.