Transportation and logistics cyber incidents by year and record status
| Year | Incident | Where | Record status |
|---|
| 2017 | NotPetya / Maersk | Global (worm aimed at Ukraine) | Russian military, per US and UK |
| 2023 | DP World Australia | Sydney, Melbourne, Brisbane and Fremantle | Attacker and vector undisclosed |
| 2023 | Port of Nagoya | Nagoya, Japan | LockBit, per press reports of the note |
| 2025 | Collins Aerospace | Heathrow, Brussels, Berlin and Dublin | Attacker undisclosed; no charge recorded |
What the headlines got wrong about transportation cyberattacks
One widely repeated claim from each entry, and what the record says. Each entry lists more, with sources.
| Widely repeated claim | What the record says | Entry |
|---|
| "A domain controller in Ghana, knocked offline by a blackout, saved Maersk." | Wired's 2018 reconstruction from mostly unnamed sources. A 2019 report of an executive's talk says Lagos. No Maersk document names either. | NotPetya / Maersk |
| "Hackers shut down Australia's ports." | DP World restricted land side access itself, by disconnecting from the internet to contain the incident. Vessels were reported still worked, and the Coordinator said some containers kept moving at one site. The halt was the gate, not the port. | DP World Australia |
| "OT Cybersecurity Breach Disrupts Operations at the Port of Nagoya, Japan"; "Japanese media reported that LockBit was the ransomware variant used in the attack and that the hacker group, LockBit 3.0, demanded a ransom for returning control of the system." | No crane, handling equipment or controller is on any record; NUTS, a terminal operating system, was encrypted. The victim says the note stated no ransom amount and that it has not contacted the attackers, and no official document names a group. The same vendor post dates the attack 5 July (NUTS stopped on 4 July) and misnames the port's operator. | Port of Nagoya |
| "Two experts independently confirmed it was HardBit ransomware." | Two social media posts, the second crediting the first, with no source given. No company or government has named the ransomware, and Everest separately claimed a data theft. | Collins Aerospace |
BlastWave analysis: one shared system
Analysis, not a disclosed factAcross the four entries, the physical operation kept moving where people could work around the failed system: ships worked by hand from paper at Nagoya, manual check-in at European airports, and vessels that Maersk said stayed maneuverable. The delays came from how much of the flow depended on one shared system, and at DP World from a containment step that cut the gate along with the office. That is BlastWave's reading of the record, not a finding of any investigator. It is why the entries' recommendations focus on separating what moves cargo and passengers from the networks that may have to be cut.
Frequently asked questions
What are the major cyberattacks on ports, shipping and airports?
The Transportation and Logistics edition documents four: NotPetya at A.P. Moller Maersk (2017), the ransomware incident at the Port of Nagoya (2023), the DP World Australia cyber incident (2023), and the ransomware incident at Collins Aerospace that disrupted check-in at European airports (2025).
How much did NotPetya cost Maersk?
Maersk put the effect of the June 2017 NotPetya attack on its profitability at USD 250-300m. That is Maersk's own figure and its own label: an effect on profitability, not an itemized cost. Maersk was collateral damage of a destructive worm aimed at Ukraine, which reached it through a backdoored Ukrainian tax software update.
Did hackers shut down Australia's ports in 2023?
No. In November 2023 DP World Australia detected unauthorized access to its corporate network and disconnected from the internet to contain it. That all but closed the land side gate at its Sydney, Melbourne, Brisbane and Fremantle terminals for three days. By the company's account no ransomware was found, and the intruder's entry route and identity remain undisclosed.
What caused the European airport check-in disruption in September 2025?
On 19 September 2025, RTX became aware of ransomware on systems supporting MUSE, Collins Aerospace's shared airport check-in software. Airlines at Heathrow, Brussels and Berlin moved to backup and manual check-in, and Dublin was also disrupted; flights were delayed and cancelled but not stopped. As of late September 2026, no company or government has named the ransomware family or the attacker.
Was the Port of Nagoya attacked by LockBit?
LockBit's name comes from press reports of the ransom note, not from any official document. In July 2023 ransomware encrypted NUTS, the system shared by all five container terminals at the Port of Nagoya, and container receiving and release stopped for about 60 hours. Neither the terminal operators' association nor Japan's transport ministry names a group.
How does Hackopedia verify a transportation incident?
Every figure, date and quotation in an entry traces to a court record, a government or regulator document, the company's own dated statements or filings, a named researcher's published work, or a dated publication named as such. Claims resting on press, leak sites or unnamed sources are marked as reported, and errors in Hackopedia's own first volume are corrected on the page.
Other editions
Cite this page
BlastWave. “Cyberattacks on Ports, Shipping and Airports: The Verified Record (2017 to 2025).” Hackopedia, Volume 2, Transportation and Logistics edition. Last verified 28 September 2026. https://hackopedia.blastwave.com/transportation-logistics/
Revision history
| Date | Change |
|---|
| 6 Oct 2026 | Transportation and Logistics edition published with four entries. FILE numbers run across all of Hackopedia Volume 2, not by edition. |
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
