Brazil’s largest port has been placed on heightened security alert after a major IT outage disrupted digital systems, with authorities investigating a suspected cyberattack linked to an international ransomware group.
The Port of Santos, one of South America’s most important maritime trade hubs, has experienced widespread disruption to its computer systems, leaving online services, internal platforms and customer access portals unavailable.
The disruption has prompted Brazilian authorities to raise the port’s security protection to Level II, introducing stricter checks on access to the complex.
The Santos Port Authority (APS) has confirmed that its systems remain affected but insists shipping operations are continuing under contingency arrangements.
An international cybercriminal group known as N0n has reportedly claimed responsibility for compromising systems associated with T2S, a major technology supplier to the port.
However, authorities have not confirmed that a ransomware attack caused the latest disruption or established whether sensitive data has been accessed.
Major Digital Disruption at Port of Santos
The problems began on Friday 6 November 2026, when an electricity failure affected servers operated by the Santos Port Authority.
Engineers initially restored services later that evening, but the systems became unavailable again during the early hours of Saturday 7 November.
The disruption affected the authority’s public website, internal computer systems and online services used by customers and businesses operating within the port.
The failure also affected digital systems associated with access control at the port’s public gates, raising concerns the management of vehicle and personnel movements.
Some administrative activities have been transferred to manual processes while engineers work to restore normal service.
Port operators have reported slower cargo handling and processing, although the authority maintains that vessels are continuing to arrive and depart.
Hackers Reportedly Demand Millions in Bitcoin
Brazilian media have linked the disruption to a reported ransomware incident involving T2S, a technology company supplying systems to the port.
According to reporting by Folha de S.Paulo, the cybercriminal group N0n previously claimed responsibility for accessing systems and demanded a cryptocurrency payment.
The reported demand amounted to 23 Bitcoin, valued at approximately US$2.4 million at the time.
The group allegedly threatened to release information concerning vessel movements and port operations if its demands were not met.
Reports indicate that the deadline associated with the demand expired on 19 October.
It remains unclear whether the reported intrusion into T2S systems is directly responsible for the latest outage affecting the Santos Port Authority.
There has been no official confirmation that the authority’s systems were encrypted by ransomware or that any ransom payment was made.
Federal Authorities Raise Port Security Level
Brazil’s State Commission for Public Security at Ports, Terminals and Waterways, known as Cesportos, raised the port’s protection status to Level II following the disruption.
The decision was formalised by Federal Police delegate Edson Patrício do Nascimento, the commission’s coordinator.
The heightened status introduces additional security controls, particularly around the movement of people and vehicles through public access points.
Cargo inspections and access verification procedures have also been strengthened.
The decision was taken because disruption to electronic gate systems could create vulnerabilities in the port’s security arrangements.
The protection scale extends to Level III, making the current designation an elevated precautionary measure rather than the maximum emergency status.
Shipping Continues Despite IT Problems
Despite the disruption to digital infrastructure, the Santos Port Authority has stressed that physical operations have not stopped.
It confirmed that vessel arrivals and departures are continuing and that land access to the port remains available.
Additional Port Guard personnel have been deployed, while alternative administrative procedures have been introduced.
The authority acknowledged that some services could take longer than usual because electronic systems were unavailable.
The situation has raised concerns the reliance of major maritime infrastructure on digital platforms used for cargo processing, access control and logistics coordination.
Prolonged disruption could affect businesses dependent on the port, although the extent of any financial or commercial impact has not been established.
Cybersecurity Specialists Work to Restore Systems
Technology teams from the Santos Port Authority are working alongside external contractors and Brazil’s Federal Data Processing Service, Serpro, to identify the source of the disruption.
Their work includes assessing the affected infrastructure and determining whether any unauthorised access occurred.
The authority has said it is taking technical, administrative and legal measures to limit the impact and restore services.
The Federal Police have been informed of the situation.
However, Brazilian reporting on Tuesday indicated that a formal federal police investigation had not yet been opened because the authorities were still awaiting documentation.
There has been no confirmed timetable for the full restoration of the port’s digital services.
Authorities Yet to Confirm Cyberattack
The Santos Port Authority has acknowledged suspicions of a cybersecurity incident but has not established the precise cause of the disruption.
Investigators are examining whether the outages resulted from the original electrical failure, malicious interference or a combination of technical and security problems.
The reported claim by the N0n ransomware group is being treated separately from the port authority’s verified statements.
For now, the port remains operational with heightened security, additional personnel and temporary procedures in place while work continues to restore its computer systems.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
