Transnet ports still clogged after IT attack

Several SA ports were still running on a paper-based system on Thursday, one week after a crippling breach of Transnet’s IT system in a cyberattack.

In Durban, meat importers and fruit exporters were struggling to find cold-storage facilities for food, with plug points running out. In Cape Town, provincial authorities said the port had lost a full week’s work.

The digital breach — reported by Bloomberg to have been caused by Death Kitty ransomware — hit the nervous system of SA’s blue economy, causing a second week of paralysis in KwaZulu-Natal, which earlier in July was brought to a halt by civil unrest.

Stakeholders in shipping and logistics look set for a second weekend of manual processing

— working with hard copies of documents rather than digital applications — to clear customs and move containers in and out of big ports.

Transnet usually manages the movement of shipping containers through Navis, a digital system. But the breach, which

cyber experts suspect was caused by ransomware, took Navis offline for days.

On Thursday, operations remained compromised at a few ports, due to a staggered return to digital systems. Operations at Cape Town, Port Ngqura in Coega and Gqeberha were still working on manual systems into Thursday afternoon.

Durban’s port was back on Navis and companies were “breathing a little bit. They can see it is working, and import containers are being evacuated from the terminals,” said Juanita Maree, chair of the SA Association of Freight Forwarders.

Late on Wednesday, minister of public enterprises Pravin Gordhan announced a “breakthrough” in the IT problem. He said the force majeure declared by Transnet on July 22 for four days was “under review with the intention to lift it in the coming days”. By Thursday evening, it was still in place.

Force majeure allows a company to waive certain contractual obligations due to an unanticipated event.

Western Cape MEC of finance and economic opportunities David Maynier said more than 10,000 containers were delayed and two vessels bypassed Cape Town in the past week. A week of work was lost.

“Three vessels, which should have been completed, are still at berth, while six container vessels are waiting at anchorage, all of which should have berthed by now,” Maynier said on Thursday.

Before this month’s crises, SA’s port competitiveness was already in deep trouble. In 2020, the World Bank ranked four SA ports among the worst in the world in terms of administration. Out of 351 ports, Cape Town was at 337, Gqeberha at 348, Port Ngqura at 349 and Durban at 351.

Efficient ports are an essential element of a country’s competitiveness and its integration with the global shipping network. The improvement of port efficiency is an important component of finance minister Tito Mboweni’s growth strategy.

Transnet recently announced plans to unbundle its port operations into a separate entity, a move aimed at attracting private participation.

David Jooste, the CEO of clearance and freight forwarding company Trade Ocean, said: “What we’ve seen is ships that have bypassed Durban in favour of Cape Town — and, more lately, vessels just bypassing SA completely.”

The SA Meat Processors Association and SA Association of Meat Importers and Exporters (AMIE SA) said cold-storage space was running out at Durban’s port on Thursday. Containers were piling up and power plugs were becoming scarce, they said.

“The current blockages are not only impacting importers but also exporters of SA products, including fruit and wine. We are already seeing a knock-on effect across the entire food value chain,” said AMIE SA CEO Paul Matthew. He predicted it would take up to 18 months for the meat industry in KwaZulu-Natal to recover after looting and Transnet’s cyberattack.

Elmarie Biermann, director of the Cyber Security Institute, said the timing of Transnet’s IT breach was a “big red flag”, as was the targeting of a critical state asset. “The issue is who is behind this? Who instigated?”

Transnet spokesperson Ayanda Shezi would not confirm the ransomware report because the attack was being investigated. She said employees had not engaged with the message that appeared on their screens and

Transnet had not been asked to pay a ransom ahead of the attack.

Biermann called for the establishment of a cybersecurity centre nationally with response plans for breaches of IT systems controlling critical state assets, such as energy and water supply. She warned that cybersecurity attacks could be deadly.

Dominic White, MD for Orange Cyberdefense in SA, said the government had systems in place to respond to breaches. He doubted the cyberattack and civil unrest were linked. “There has been no proof one way or the other that it’s related.”

White reported that analysts were monitoring the dark web for mention of the attack. “We’re on the lookout for people trying to sell data that purports to come from Transnet and — as yet — we haven’t seen anything,” he said.

THE DIGITAL BREACH HIT THE NERVOUS SYSTEM OF SA’S BLUE ECONOMY, CAUSING A SECOND WEEK OF PARALYSIS IN KWAZULU-NATAL

COLD-STORAGE SPACE WAS RUNNING OUT AT DURBAN’S PORT. CONTAINERS WERE PILING UP AND POWER PLUGS WERE BECOMING SCARCE