In November 2023 DP World Australia found an intruder on its corporate network and cut itself off from the internet. That contained the intrusion, and all but closed the land side gate at four container terminals for three days.
DP World Australia wrote the entry's argument itself. Disconnecting its network from the internet, the company said, “impacted land-side port operations” and “also successfully contained the incident.” Both halves are true, and the second is why the first happened. Nothing public shows the intruder reaching terminal systems. Here the halt was the defence, and the operator resumed within three days.
The architecture question is what that one lever was wired to. A land side gate trades information with hauliers, shipping lines and border agencies, so an outside connection is part of how it works. If that connection shares a path with the office, containing the office closes the gate. That is BlastWave's analysis rather than a disclosed fact, since DP World has not published its network design. The lesson is not faster detection. It is building the gate so the office can be cut without it.
What is not known: DP World has never said how the intruder got in. The CitrixBleed explanation is an outside inference by two researchers, reported by the ABC, which the company neither confirmed nor disputed. Nobody has claimed the intrusion and no government has attributed it. How long the intruder was inside before 10 November is unpublished. So is which gate systems depended on the connection that was cut, and whether terminal systems were ever reachable from the corporate network. The cost and the outcome of the police investigation are undisclosed.
Recommendation
Take the path away from the gate The land side gate, vehicle bookings and terminal operating system reach outside counterparties on their own path, not through the corporate network you may have to cut.
Remove standing access at the edge A remote access gateway answers nothing it has not authenticated, and each session is bound to an enrolled device, so a leaked token or password opens nothing.
Read one way; rehearse the gate by hand Reporting and billing take terminal data over a one-way path, and the gate has a manual procedure exercised on a calendar, before anyone needs it.
Sources: DP World Australia statement, 28 Nov 2023; National Cyber Security Coordinator, via AFP and ABC, 11 to 13 Nov 2023; ABC News, 17 Nov 2023; Citrix CTX579459, 10 Oct 2023; AA23-325A, 21 Nov 2023 (does not name DP World). Full list with links.
Soft Spots: CitrixBleed is an outside inference DP World never confirmed or disputed. That the gate shared a path with the office network is BlastWave's analysis; no public evidence of terminal compromise is not evidence of none.
The full record
Every claim numbered to its source. Last updated .
An intruder on the corporate network, and a disconnection from the internet that contained it and all but closed the land side gate at four container terminals. What is verified, what is only reported, and what is still unknown.
Summary
In November 2023, DP World Australia detected unauthorized access to its corporate network and disconnected from the internet. By the company's account that contained the incident, and no ransomware was found. It also all but closed the land side gate at its Sydney, Melbourne, Brisbane and Fremantle terminals for three days. The intruder's entry route and identity remain undisclosed.1
Timeline of the DP World Australia incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Citrix releases fixed builds for CVE-2023-4966, the flaw known as CitrixBleed, under security bulletin CTX579459. NetScaler's public update of 23 October records the 10 October release.10
DP World Australia's technology team detects unauthorized access to the company's Australian corporate network. To contain it, the team disconnects the network from the internet.1
DP World says it has "restricted landside access to our Australian port operations." The National Cyber Security Coordinator names the four terminals and calls it a "nationally significant cyber incident." ABC News reports ships could still unload while cargo could not leave.2,3
The Coordinator, as quoted by ABC News, says interruptions are likely to last "a number of days, rather than weeks."4
Port operations resume. The Coordinator, in an ABC interview as reported by CNN, says the port's operational technology had been taken offline. The Minister for Home Affairs says about 5,000 containers will move that day.1,5,6
ABC News reports the analysis of two outside researchers that DP World had been running an internet-facing Citrix system vulnerable to CitrixBleed. DP World does not respond or dispute it.8
DP World clears its backlog of 30,137 containers, seven days after restart and ten after detection.1
US agencies and Australia's ASD's ACSC publish advisory AA23-325A on LockBit 3.0 affiliates exploiting CitrixBleed. It names Boeing, not DP World.11
DP World states its investigation found no ransomware, and that files were accessed and a small amount of data exfiltrated, including employee personal information. Asked who was responsible, its regional executive tells ABC News, "I wish I knew."1,9
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Where was the intruder detected?
On DP World Australia's Australian corporate network1
Verified
What stopped the land side gate?
The company's own disconnection from the internet, made to contain the incident1
Verified
Was ransomware involved?
"No ransomware was found or deployed," per the company's investigation1
Undisclosed by DP World. CitrixBleed is an outside inference the company neither confirmed nor disputed8
Researcher inference
Who was responsible?
No claim and no government attribution, as of late September 20269
Undisclosed
Did the LockBit advisory name DP World?
No. AA23-325A names Boeing and no Australian victim11
Verified
Did ships stop?
Vessels reported still worked; the impact was land side2,7
Reported only
Were terminal systems compromised?
Not shown in any public record. That is not evidence of none
Undisclosed
What data was taken?
Files accessed, a small amount exfiltrated, including current and former employees' personal information; customer data not affected1
Verified (company statement)
Time to clear the backlog
30,137 containers by 20 November, ten days after detection1
Verified
Incident cost
Not published
Undisclosed
Did hackers shut down Australia's ports?
No. DP World closed its own land side gate by disconnecting from the internet, and by its account that contained the intrusion. The company's statement of 28 November 2023 puts both effects in one sentence:1
"While this impacted land-side port operations it also successfully contained the incident."
The company's word was "land-side." Its first public statement said it had "restricted landside access to our Australian port operations while we continue our investigation."2Contemporaneous reporting described vessels still being worked while freight could not leave; at Fremantle, ship movements continued with only land side truck operations disrupted.2,7 The halt was the gate, not the port.
The gate was not wholly shut. The National Cyber Security Coordinator, Air Marshal Darren Goldie, said in an ABC interview on 13 November, as reported by CNN, that the company had kept the ability to retrieve certain sensitive cargo and continue moving some containers across one of its sites.5 Operations resumed that Monday, and DP World cleared its backlog of 30,137 containers by 20 November.1
"This interruption is likely to continue for a number of days and will impact the movement of goods into and out of the country."
Was DP World Australia hit by ransomware?
No ransomware was found, by the company's own investigation. On 28 November 2023 DP World quoted its investigation's finding:1
"no ransomware was found or deployed within the DP World Australia network (no ransomware executables, no encrypted files and no ransom demands)."
On 21 November 2023, eleven days after DP World's detection, CISA, the FBI, MS-ISAC and ASD's ACSC published joint advisory AA23-325A on LockBit 3.0 ransomware affiliates exploiting the same Citrix flaw. It names Boeing Distribution Inc. It does not name DP World, any port or any Australian victim.11 The same flaw in the same month is adjacency, not attribution.
How did the intruder get into DP World Australia?
DP World has never said. CitrixBleed is an outside inference that the company neither confirmed nor disputed. On 17 November 2023, ABC News reported analysis by two researchers, Kevin Beaumont and Matthew Remacle, that DP World had been running an internet-facing Citrix NetScaler system vulnerable to CVE-2023-4966, known as CitrixBleed, which the vendor had patched on 10 October 2023.8,10 The ABC wrote that DP World "did not respond to the ABC's questions or dispute the details of this analysis."8
Remacle's own words were that CitrixBleed as the initial foothold "is certainly within the realm of possibility."8 That is the grain the record supports: a strong inference, not a finding.
Asked by the ABC on 28 November whether unpatched systems had left the company exposed, DP World's regional executive did not answer directly. He put the question to himself instead:9
"if I could go back in time a month and say, 'would you have done some things differently?' I probably would have."
Who was behind the DP World cyber incident?
No one has been publicly identified. No group has claimed the intrusion on a leak site or in a note, and no government has attributed it, as of late September 2026. Asked who was responsible, the company's regional executive told ABC News on 28 November 2023: "I wish I knew."9
The Coordinator said at the time that attribution "takes significant time and there's a very high bar for the standard of proof," as reported by Industrial Cyber.6 The LockBit advisory published that month does not name DP World.11
Did the intruder reach DP World's terminal systems?
Nothing public shows it. That is a statement about what has been published, not proof of what happened. DP World located the unauthorized access on its Australian corporate network.1 It has not said whether terminal systems were reachable from that network.
On 13 November 2023 the Coordinator told the ABC, as reported by CNN, that the port's "operational technology, which allows the actual port to work," had been taken offline.5 CNN does not say by whom. Read against DP World's own account of disconnecting to contain the incident, the record reads that as the response, not the attack.
What data was taken in the DP World breach?
A small amount of data, including personal information of current and former employees, by the company's account. DP World said some files were accessed and "a small amount of data" was exfiltrated, that customer data was not affected, and that the incident was confined to its Australian operations.1 Its regional executive told ABC News the employee data included telephone numbers, addresses and, in some cases, "a copy of a drivers licence."9 The number of employees affected has not been published.
What is still not known about DP World Australia
How the intruder got in. DP World has never said; CitrixBleed is an outside inference it neither confirmed nor disputed.8
Who was responsible. No claim and no government attribution, as of late September 2026.
How long the intruder was inside before 10 November 2023.
Which systems at the land side gate depended on the connection that was cut.
Whether terminal systems were ever reachable from the corporate network.
The number of employees whose data was taken.
The cost of the incident.
The outcome of the police investigation.
Claims about DP World Australia the record does not support
Widely repeated claim
What the record says
"Hackers shut down Australia's ports."
DP World restricted land side access itself, by disconnecting from the internet to contain the incident. Vessels were reported still worked, and the Coordinator said some containers kept moving at one site. The halt was the gate, not the port.1,2,5,7
BlastWave analysis: the response closed the gate, and it was right to
Analysis, not a disclosed fact
DP World Australia wrote this entry's argument itself: the disconnection "impacted land-side port operations" and "also successfully contained the incident." Both halves are true, and the second is why the first happened. With an intruder present on the corporate network and nobody yet able to say how far it had reached, the lever that settled the question also all but closed the gate at four container terminals. That places the incident on the rung of IT compromise halting physical operations, reached by containment alone: here the halt was the defense. That the disconnection was the correct call is BlastWave's judgment of the company's decision; the company says it contained the incident, and nothing in the record contradicts it. The operator detected the access, contained it, resumed within three days and cleared a backlog of 30,137 containers within ten.1
The architecture question is what that one lever was wired to. A land side gate trades information with hauliers, shipping lines and border agencies, so an outside connection is part of how it works. If that connection shares a path with the office, containing the office closes the gate. That is BlastWave's analysis rather than a disclosed fact, since DP World has not published its network design. The lesson is not faster detection. It is building the gate so the office can be cut without it, and practicing the gate by hand before anyone needs to.
Podcast: “The Store Lockdown” (8:57). Joe Baxter and Cam Cullen on why pulling the internet was the right call, and why that one lever also closed the gate.
Video: DP World Australia Short (60 to 90 seconds).
Frequently asked questions
What happened in the DP World Australia cyber incident?
On Friday 10 November 2023, DP World Australia detected unauthorized access to its Australian corporate network and disconnected the network from the internet to contain it. The company said on 28 November that this contained the incident but impacted land side port operations. The affected terminals were in Sydney, Melbourne, Brisbane and Fremantle. Operations resumed on 13 November, and a backlog of 30,137 containers was cleared by 20 November.
Was the DP World Australia incident ransomware?
DP World said on 28 November 2023 that its investigation found no ransomware was found or deployed within its network, meaning no ransomware executables, no encrypted files and no ransom demands. A joint advisory on LockBit 3.0 affiliates exploiting the same Citrix flaw, AA23-325A, was published on 21 November 2023, but it names Boeing and does not name DP World.
Was DP World hacked through CitrixBleed?
DP World has never said how the intruder got in. ABC News reported on 17 November 2023 the analysis of two outside researchers, Kevin Beaumont and Matthew Remacle, that DP World had been running a Citrix system vulnerable to CitrixBleed. The ABC wrote that DP World did not respond to its questions or dispute the analysis. It remains an outside inference, never confirmed by the company.
Who was behind the DP World cyberattack?
Nobody has claimed the intrusion and no government has attributed it, as of late September 2026. Asked who was responsible, DP World's regional executive told ABC News on 28 November 2023, "I wish I knew." The LockBit advisory published that month does not name DP World, so linking the incident to LockBit is adjacency, not attribution.
Did the DP World incident shut down Australia's ports?
Not in the sense usually reported. DP World disconnected its own network from the internet to contain the intrusion, which all but closed the land side gate at four container terminals from 10 to 13 November 2023. Press reports at the time said vessels were still being worked. The National Cyber Security Coordinator said, as reported by CNN, that some containers kept moving at one site.
Did the hackers reach DP World's operational technology?
Nothing published shows the intruder reaching terminal systems, though that is not proof it did not. DP World located the access on its corporate network. The National Cyber Security Coordinator said on 13 November 2023, as reported by CNN, that the port's operational technology had been taken offline; read against the company's account, that describes the response rather than the attack.
What data was stolen from DP World Australia?
DP World said on 28 November 2023 that some files were accessed and a small amount of data was exfiltrated, including personal information of current and former employees, and that customer data was not affected. Its regional executive told ABC News the data included telephone numbers, addresses and, in some cases, a copy of a driver's license. The number of employees affected has not been published.
Primary sources are DP World Australia's own dated statements, the vendor's bulletin and the joint government advisory. The National Cyber Security Coordinator's statements reached us through press republication, and press is cited as evidence of what was said.
CompanyDP World Australia, "Media Statement: Update on Cybersecurity Incident," 28 November 2023. dpworld.com
PressABC News, 11 November 2023: DP World's initial statement and the National Cyber Security Coordinator's statements of that day. Cited as evidence of what was said. abc.net.au
PressNational Cyber Security Coordinator, Air Marshal Darren Goldie, post on X, 11 November 2023, as quoted by AFP. Cited as evidence of what was said.
PressABC News, 12 November 2023: the National Cyber Security Coordinator on the expected duration. Cited as evidence of what was said. abc.net.au
PressCNN, 13 November 2023: report of the National Cyber Security Coordinator's ABC interview that day. Cited as evidence of what was said. cnn.com
PressIndustrial Cyber, November 2023: statements by the National Cyber Security Coordinator and by Clare O'Neil MP, Minister for Home Affairs and Cyber Security, 13 November 2023. Cited as evidence of what was said. industrialcyber.co
PressDark Reading, 13 November 2023: vessels still worked at Fremantle while land side operations were disrupted. Cited as evidence of what was said. darkreading.com
PressABC News, Julian Fell, "Port operator DP World failed to fix 'critical' CitrixBleed vulnerability in IT systems," 17 November 2023. Cited as evidence of what was said. abc.net.au
PressABC News, Kate Ainsworth and Kirsten Aiken, 28 November 2023: interview with DP World's executive vice president. Cited as evidence of what was said. abc.net.au
CompanyNetScaler (Cloud Software Group), "CVE-2023-4966: Critical Security Update Now Available," 23 October 2023; fixed builds released 10 October 2023 under bulletin CTX579459. netscaler.com
GovernmentCISA, FBI, MS-ISAC and ASD's ACSC, joint advisory AA23-325A, "#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability," 21 November 2023. Names Boeing Distribution Inc.; does not name DP World. cyber.gov.au · cisa.gov
Cite this page
BlastWave. “DP World Australia Cyber Incident (2023): What Is Verified.” Hackopedia, Volume 2, FILE 009. Last verified 28 September 2026. https://hackopedia.blastwave.com/transportation-logistics/dp-world-australia-2023/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 009 in Hackopedia Volume 2, in the Transportation and Logistics edition.
28 Sep 2026
Hand-check and cross-entry review. Re-checked that no claim of responsibility or government attribution had appeared. Comparisons with NotPetya and Maersk restated to match that entry's record: Maersk's terminal systems were partly destroyed and partly shut down as a precaution.
26 Sep 2026
Full validation against DP World's statement, the vendor bulletin, the joint advisory and the press reports that carry the Coordinator's words. The gate is now described as all but closed rather than shut, because the Coordinator said some containers kept moving at one site. The executive's "I probably would have" now carries his own framing of the question.
24 Sep 2026
Volume 2 entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
