Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
Transnet port systems ransomware attack, 2021
On Thursday 22 July 2021 Transnet, South Africa's state-owned ports and freight company, suffered an IT security breach that it later said was a ransomware attack.
In short
On Thursday 22 July 2021 Transnet, South Africa's state-owned ports and freight company, suffered an IT security breach that it later said was a ransomware attack. It shut down systems, and some servers and workstations were encrypted. Container terminals at the main ports slowed or switched to manual work, and Transnet declared force majeure on 26 July. Government said full port operations were restored by 29 July.
What happened
The Department of Public Enterprises said an IT security breach at Transnet happened on the morning of Thursday 22 July 2021. In a reply to Parliament, Transnet said it was a ransomware attack. It first shut down all ICT systems to stop the spread of the malware, and some servers and workstations that were online at the time were encrypted. A criminal investigation was in progress (Parliament question NW1893, 7 October 2021).
Transnet Port Terminals runs the container terminals at the biggest South African ports. Questions in Parliament say it declared force majeure late on 26 July 2021. Some terminals worked manually, while others could not run in manual mode because of the complexity of their operations. This slowed vessel and truck turnaround (reply to NW1829, 15 October 2021). Bulk, break bulk and automotive operations switched to manual, and government said disruption there was minimal.
On 29 July the Minister of Public Enterprises said Transnet had fully restored port operations. The NAVIS terminal operating system was back, the Durban container terminals were functional on NAVIS, and the truck booking system was activated on 28 July. Government said preliminary assessment showed Transnet and customer data had not been compromised, and that rail ran on schedule.
Members of Parliament asked about delays, ports above full container capacity and vessels skipping South African ports. Transnet replied that the impact on volumes through South African ports was negligible and that it was wrong to say the force majeure caused a ports crisis.
See also the South African Department of Justice ransomware attack of 2021, another South African ransomware incident.
Timeline
-
22 July 2021
The IT security breach occurs on the morning of this day, according to the Department of Public Enterprises. Transnet says ICT problems began that day.
-
24 July 2021
A manual evacuation process for containers at the Cape Town Container Terminal starts, according to a Parliament question.
-
26 July 2021
Transnet gives notice of a force majeure, according to Parliament questions.
-
27 July 2021
The Durban container terminals are functional on NAVIS, with other interface systems still being restored.
-
28 July 2021
The truck booking system is activated. A weekly recovery session with Business Unity South Africa begins.
-
29 July 2021
The Minister of Public Enterprises says full port operations are restored, the force majeure is under review and investigations are under way.
-
6 August 2021
A member tells Parliament's Transport committee that some ports were over 100% container capacity and vessels had omitted South African ports.
-
20 September 2021
The planned end date of the weekly recovery sessions with Business Unity South Africa.
-
7 October 2021
The Minister's written reply to NW1893 sets out Transnet's account: ransomware, systems shut down, two incident response teams, a criminal investigation.
-
15 October 2021
The reply to NW1829 says no IT systems were compromised or lost at Transnet Port Terminals and no long-term impact is foreseen.
How the attack worked
The public record on how the attack worked is thin. Transnet’s account comes from written replies to Parliament, passed on by the Minister of Public Enterprises. It does not say how the attackers got in, and no public source opened names the attacker.
Ransomware on servers and workstations
Transnet says it was a ransomware attack. Some servers and some workstations that were online at the time were encrypted by the ransomware, which is Data Encrypted for Impact (T1486). Transnet says the surface of the attack was the server domain and applications, and that the port networks themselves were not negatively affected.
Shutdown to stop the spread
Transnet shut down all ICT systems at first to stop the spread of the malware. Because the systems that run container terminals depend on IT, some terminals ran manually while others could not.
Rebuild
One incident response team helped rebuild the active directory servers. A second team contained the incident and ran a forensic scan of every machine. Transnet put an endpoint detection and response agent on each machine before it came back online, upgraded and patched older operating systems, and added a web access firewall, reverse proxy and anti-DDoS system for public websites.
Sources differ on the date. The Department of Public Enterprises places the breach on 22 July 2021. A Parliament reply on 7 October 2021 speaks of an incursion on 26 July 2021, which other Parliament questions give as the date of the force majeure notice.
- Ransomware reaches systemsTransnet says it was a ransomware attack; how it got in is not stated
- Servers and workstations encryptedSome servers and workstations online at the time were encryptedTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- Systems shut downTransnet shut down all ICT systems to stop the spread of the malware
- Terminals slow or go manualSome container terminals worked manually, others could not, slowing vessels and trucks
- Rebuild and restoreTwo response teams rebuilt servers and scanned all machines; NAVIS restored
ATT&CK techniques
Who says who was behind it
No public attribution. In a written reply to Parliament (7 October 2021) Transnet said it was a ransomware attack and that a criminal investigation was in progress, including into who was responsible.
The Minister of Public Enterprises said on 29 July 2021 that investigations were under way and due process would take place.
Impact
Department of Public Enterprises, 29 July 2021: preliminary assessment showed Transnet and customer data had not been compromised. Shipping lines carrying 70% of the cargo said South African ports would not be bypassed. Rail ran on schedule. Bulk, break bulk and automotive operations moved to manual with minimal disruption.
Transnet, 7 October 2021: container volumes were delayed by the attack or the resulting congestion. Automotive vessels were delayed. Transnet judged the impact on volumes through South African ports to be negligible.
Transnet, 15 October 2021: some terminals ran manually, others could not, which slowed vessel and truck turnaround. No IT systems were compromised or lost at Transnet Port Terminals and no long-term impact was foreseen.
Parliament, 6 August 2021: a member said some ports were over 100% container capacity and that vessels had omitted South African ports.
Sources differ on the scale of the knock-on effect. Questions in Parliament speak of a ports crisis. Transnet says that is not accurate and points to other causes in global shipping. The sources opened give no money figure.
Government and regulator response
- 22 to 26 July 2021: Transnet shut down its ICT systems, brought in incident response teams, moved some operations to manual work and gave notice of force majeure on 26 July.
- 27 to 29 July 2021: NAVIS and customer links were restored, the Durban container terminals were functional, and the truck booking system restarted on 28 July. The Minister of Public Enterprises said full port operations were restored and the force majeure was under review.
- Stakeholders: Transnet held daily meetings and sent letters to customers, a weekly session with Business Unity South Africa from 28 July (planned to end 20 September), and a weekly engagement with citrus stakeholders. The Minister also set up a platform for talks with chief executives of affected companies.
- Security changes: endpoint detection and response on all machines, patched operating systems, a web access firewall, reverse proxy and anti-DDoS protection for public websites.
- Regulator: the Transnet National Ports Authority engaged the Ports Regulator on measures to follow if a similar incident recurs.
- Investigation: a criminal investigation was in progress as of 7 October 2021.
Lessons
-
Shutting down limits spread but stops work
Transnet shut down all ICT systems to stop the malware. Plan what each site does when the systems it depends on are switched off.
-
Some operations cannot run by hand
Some terminals worked manually while others could not. Test manual modes for each critical site, not only the easy ones.
-
Keep customers informed
Transnet held daily meetings and sent letters. Regular, structured updates kept shipping lines engaged through recovery.
-
Rebuild with monitoring on every machine
Machines came back with an endpoint agent and current patches. Do not restore old, unpatched systems.
-
Directory servers are central
The response teams had to rebuild the active directory servers. Practise rebuilding identity systems.
-
Separate IT impact from market effects
Transnet and Parliament disagreed on whether the attack caused a ports crisis. Record clearly what the incident caused and when.
What to check in your own organization
-
Manual mode
For each terminal, depot or plant, confirm in writing and by test whether it can run without its operating system.
-
Shutdown decision
Agree who can order a full shutdown to stop ransomware and how quickly.
-
Directory rebuild
Check you can rebuild Active Directory from clean backups and who has the skills or the contract to do it.
-
Endpoint coverage
Check that every server and workstation, including old ones, has endpoint detection and response and current patches.
-
Public websites
Check that public websites sit behind a web firewall and DDoS protection.
-
Customer communication
Prepare a stakeholder update routine, with daily calls and letters, before an incident.
-
Regulator contact
Know which regulators to inform if your operation is licensed or regulated.
Where it happened
Questions
When did the attack happen?
The Department of Public Enterprises places the IT security breach on the morning of Thursday 22 July 2021.
Was it ransomware?
Yes, according to Transnet's written reply to Parliament of 7 October 2021. Some servers and workstations were encrypted.
Was data stolen?
The government's preliminary assessment on 29 July 2021 said Transnet and its customer data had not been compromised. Transnet later said no IT systems were compromised or lost at Transnet Port Terminals.
Who did it?
No public attribution. A criminal investigation was in progress as of October 2021.
How long did recovery take?
The Minister said port operations were fully restored by 29 July 2021 and credited Transnet IT teams with restoring systems within a week. Transnet said it kept meeting stakeholders until supply chains normalized.
Sources
- Minister Pravin Gordhan commends Transnet for restoring full ports operations (29 July 2021) South African Government (Department of Public Enterprises)
- Question NW1893 to the Minister of Public Enterprises, reply (7 October 2021) Parliamentary Monitoring Group (Parliament question and reply)
- Question NW1829 to the Minister of Public Enterprises, reply (15 October 2021) Parliamentary Monitoring Group (Parliament question and reply)
- Question NW2019 to the Minister of Public Enterprises, reply (15 October 2021) Parliamentary Monitoring Group (Parliament question and reply)
- Question NW2018 to the Minister of Public Enterprises, reply (11 November 2021) Parliamentary Monitoring Group (Parliament question and reply)
- RSR and PRSA 2020/21 Annual Report, Transport Portfolio Committee (6 August 2021) Parliamentary Monitoring Group (Parliament committee record)
- Data Encrypted for Impact, Technique T1486 - Enterprise MITRE ATT&CK
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.