Executive Summary
On 10 November 2023, DP World Australia disconnected its port operations systems from the internet after detecting a cyberattack. The disconnection halted container movement at DP World’s four Australian ports: Port Botany (Sydney), the Port of Melbourne, the Port of Brisbane, and the Port of Fremantle. The ports remained closed to container movement for approximately four days, with partial operations resuming on 13 November.
At the time of the attack, DP World managed approximately 40 percent of Australia’s container port capacity. The shutdown stranded approximately 30,000 containers. The containers included consumer goods, perishable cargo, industrial equipment, and components in manufacturing supply chains. The economic cost of the disruption, including demurrage, delayed supply chains, and emergency rerouting, was substantial though not precisely calculated publicly.
The Australian government invoked the new National Cyber Security Coordinator (NCSC) role, established only months earlier, to coordinate the response. The DP World incident became the first major test of Australia’s new critical infrastructure incident response coordination machinery.
The specific technical vector of the attack has not been publicly confirmed as of this report. Investigation findings were shared with DP World and the Australian government but have not been released publicly.
Incident Overview
Date: 10 to 13 November 2023
Organisation: DP World Australia (subsidiary of DP World, a Dubai-based global port operator; the largest port operator in Australia by throughput)
Ports affected: Port Botany (Sydney), Port of Melbourne, Port of Brisbane, Port of Fremantle (Western Australia)
Impact: Approximately 30,000 containers stranded; four days of suspended container movement; approximately 40% of Australia’s container port capacity offline
Response coordination: Australian National Cyber Security Coordinator (NCSC); Australian Federal Police; Australian Signals Directorate
Technical vector: Not publicly confirmed; investigation was conducted and findings shared with government and DP World
Resumption: Partial operations resumed 13 November 2023; full operations resumed over subsequent days
Technical Analysis: What Is Known and What Is Not
DP World has not publicly disclosed the specific technical mechanism of the attack. The Australian government similarly has not released technical details from the investigation. The following analysis draws on publicly available information about the attack and general knowledge of attack patterns against managed logistics operators.
What is confirmed:
- DP World detected the attack and, as a containment measure, severed its port systems’ internet connectivity
- This severing of connectivity was itself the cause of the operational shutdown: DP World’s port management systems relied on internet connectivity for operations, and severing that connectivity halted operations
- The attack affected DP World’s Australian operations specifically; the parent company’s other global port operations were not reported as affected
- Australian government cybersecurity agencies responded and provided technical assistance
The irony of network disconnection as containment:
A common first response to detecting an active cyberattack is network isolation: disconnecting affected systems from external connectivity to prevent the attacker from maintaining access, receiving commands, or exfiltrating data. For most organisations, this is a disruption but not a complete operational shutdown.
For DP World’s port operations, internet connectivity was not a secondary function but an integral operational requirement. The port management systems, including systems for container tracking, crane scheduling, truck queuing, and customs documentation processing, relied on internet-connected infrastructure. Severing the internet connection to contain the attack simultaneously shut down the operational capability of the ports.
This creates a difficult incident response decision: accept the operational shutdown to contain the attack and protect system integrity, or attempt to continue operations while managing an active threat, accepting the risk of further damage. DP World chose containment.
The broader question:
Why did port management systems require continuous internet connectivity for core operations? Cloud-hosted port management platforms that require internet access for basic container tracking functions are common in modern logistics operations. The transition from on-premises to cloud-hosted port management systems, while offering operational benefits, creates a dependency that converts an internet outage (or a forced disconnection for security reasons) into an operational failure.
Supply Chain Disruption as a Critical Infrastructure Metric
The DP World incident illustrates that supply chain disruption is itself a critical infrastructure risk metric, distinct from the direct damage to the attacked organisation.
The port concentration problem:
DP World operated four of Australia’s major container ports. As the operator with the largest share of container port capacity, a single successful attack on DP World’s systems created a nationwide supply chain disruption effect. A more distributed port operator landscape, where multiple competing operators manage different ports, would have been more resilient to a single operator’s systems failure.
Containers as supply chain nodes:
The 30,000 stranded containers were not homogeneous. They included:
- Consumer goods awaiting distribution to retailers
- Perishable cargo (food, pharmaceuticals) with strict temperature and time requirements
- Industrial components needed for manufacturing operations
- Export cargo with vessel departure deadlines
Each category of stranded cargo has a different cost profile for delay. Perishable cargo that cannot be moved to refrigerated storage begins to deteriorate. Manufacturing operations that rely on just-in-time component delivery halt when the components do not arrive. Retailers managing inventory levels for seasonal demand windows face gaps.
The supply chain effect of a four-day port shutdown extends beyond the direct cost to DP World and its customers to the broader economic cost of delayed production, spoilage, and supply chain disruption across sectors that rely on imported goods or export capacity.
The national security dimension:
Port infrastructure is classified as critical infrastructure in Australia under the Security of Critical Infrastructure Act 2018 (SOCI Act). The SOCI Act imposes obligations on critical infrastructure asset owners and operators, including risk management programs and incident reporting requirements.
The DP World incident was the first major test of the SOCI Act’s incident coordination mechanisms and of the National Cyber Security Coordinator role. The coordination machinery functioned: government agencies responded quickly, technical assistance was provided, and the resumption of operations was managed in an orderly manner.
ITGC Control Failures: Assessing the Unknown Vector
Because the specific technical vector of the DP World attack has not been publicly confirmed, the following analysis focuses on the control failures that the incident response revealed and that are consistent with common attack patterns against logistics operators.
Incident Detection and Response Activation: DP World detected the attack and acted to contain it within a timeframe that, while not preventing disruption, prevented the attack from causing more extensive damage. The detection and response capability was sufficient to identify the attack and take containment action.
Operational Continuity Architecture for Internet-Dependent Systems: The core architectural finding of the incident is that DP World’s port management systems could not continue operating when internet connectivity was severed. A resilient critical infrastructure architecture should ensure that core operational functions can continue for a defined period without internet connectivity. For port operations, this means a local fallback mode that supports essential container tracking and movement functions during a connectivity outage.
Incident Response Planning for Operational Technology Environments: The decision to sever internet connectivity as a containment measure, and the operational impact that followed, should have been a known and pre-planned scenario. Incident response plans for organisations with internet-dependent operational systems should include a defined playbook for the “sever connectivity” decision, including the expected operational impact and the coordination required to manage that impact.
Third-Party and Supply Chain Security: Managed logistics operators are targets because attacking them creates downstream disruption across the supply chains they serve. A port operator’s security posture is a supply chain security issue for the importers, exporters, and shipping companies that depend on that port. Government oversight of critical infrastructure operators’ security posture, through the SOCI Act risk management program requirements, is the mechanism by which this supply chain security risk is addressed.
Communication During Multi-Stakeholder Incidents: The DP World incident involved multiple stakeholders: the ports themselves, the shipping companies with vessels waiting offshore, the importers and exporters with stranded cargo, the customs authorities, the transport companies with truck queues, and the government. Communication during the incident, and the coordination of resumption of operations across these stakeholders, was a significant operational challenge.
The SOCI Act and Critical Infrastructure Security
The DP World incident occurred within the context of Australia’s updated critical infrastructure security regulatory framework. The Security of Critical Infrastructure Act 2018, significantly amended in 2021 and 2022, created a comprehensive framework for critical infrastructure security that includes:
Mandatory incident reporting: Critical infrastructure asset owners must report significant cyber incidents to the Australian Signals Directorate within defined timeframes.
Risk management programs: Owners of assets in specified critical infrastructure sectors must develop and maintain risk management programs that address physical, personnel, and cyber security.
Government assistance powers: The framework provides powers for government agencies to provide technical assistance, and in extreme cases to direct the owner of a critical infrastructure asset in their incident response.
The NCSC role: The National Cyber Security Coordinator, a role created in 2023, coordinates the government’s response to significant cyber incidents affecting Australian organisations, including critical infrastructure.
DP World’s incident was handled under this framework. The NCSC coordinated the government response, and the ASD provided technical assistance. The incident demonstrated that the coordination machinery worked but also identified areas for improvement in communication with the broader supply chain stakeholders affected by a port shutdown.
Lessons and Recommendations
Design port management systems with a local fallback operational mode. Core container tracking and movement functions should be operable in a reduced-connectivity or no-connectivity mode for a defined period. The architecture should be tested under simulated connectivity loss to confirm that essential operations can continue.
Develop a pre-defined response playbook for the connectivity severance decision. The decision to sever internet connectivity during an active attack is high-stakes and time-pressured. Pre-defined criteria for making this decision, and a pre-planned communication and coordination process for managing the operational impact, reduce the response time and improve the quality of the decision.
Conduct supply chain disruption exercises that include port shutdown scenarios. Importers, exporters, and shipping companies that depend on specific port operators should include a port shutdown scenario in their business continuity exercises. Understanding the alternative routing and temporary storage options before an incident occurs reduces the response time when one does.
Engage with the SOCI Act risk management program requirements as a genuine security improvement process. The risk management program requirements of the SOCI Act are a framework for identifying and addressing security risks. For critical infrastructure operators, treating this as a genuine security improvement process, rather than a compliance checkbox, produces better security outcomes.
Assess concentration risk in critical infrastructure dependencies. When a single operator controls 40 percent of a nation’s container port capacity, the security of that operator is a national supply chain risk. Policymakers and regulators should assess concentration risk in critical infrastructure and consider whether diversity of operator is a risk management tool.
Assessment Framework for Logistics and Maritime Operators
The ITGC controls most directly implicated in this incident map to the following audit testing areas:
- Operational continuity architecture: local fallback capability for internet-dependent operational systems
- Incident response planning: connectivity severance decision criteria and impact management playbook
- SOCI Act risk management program implementation and testing
- Stakeholder communication planning for multi-party incidents
- Network segmentation and detection capabilities for managed logistics environments
Open the ITGC Audit Tool
