In July 2023 ransomware encrypted the one system that ran all five container terminals at Nagoya, Japan's largest port by tonnage. Ships were worked by hand from paper, with delays. The gates stayed shut for about 60 hours.
Nagoya sits on the rung this volume returns to most often: an IT compromise halting physical operations. Nothing on the record reached a crane or controller. Ransomware encrypted NUTS, which tells five terminals which box goes where. We assumed Nagoya had no manual mode. The record corrects us: the ministry’s committee says ships were worked by hand from paper instructions, with delays, and it is said no ship skipped the port. The gate stopped.
The committee qualifies its praise: the manual work was possible because staff who did the job before computerisation were still there, and records the view that preparing to do everything by hand is unrealistic. The fallback lived in people, not in a plan. Sixty hours was set long before July: a maintenance VPN open to the internet, and three days of backups carrying the malware. That the gate needed a designed manual path is BlastWave’s analysis, not a disclosed fact.
What is not known: How the attacker got in is not settled: the ministry’s committee cannot determine the route definitively, points to a maintenance VPN open to the whole internet, and cannot rule out another route, because the logs were encrypted too. No official document names a group; the LockBit name comes from press reports of the printed note’s header, which stated no ransom amount. The vulnerabilities used, the system’s builder, how much cargo moved by hand and the cost are undisclosed; no data leak was traced as of 26 July.
Recommendation
Take the maintenance path away The system that gates five terminals should not answer the internet. MLIT found a maintenance VPN with no address limit, open to anyone with the right ID and password.
Remove standing credential access The vendor’s emergency door exists only while a named, multi-factor, time-boxed session is open, and every session is logged where the system cannot erase it.
Make recovery copies read one way Backup generations, logs and a printed yard state leave through a one-way path to a place the system cannot write back to, so the gate has something true to work from.
Sources: Nagoya Harbor Transportation Association report, 26 Jul 2023; MLIT committee interim summaries, 29 Sep and 30 Nov 2023; final report, 24 Jan 2024; Nagoya Port Authority statistics; Jiji, 5 Jul; Asahi, 12 Jul 2023; No government advisory. Full list with links.
Soft Spots: The LockBit name is press, not record. The VPN is MLIT’s best view, not a finding. That the gate needed a designed manual path, and that the fallback lived in people, is BlastWave’s analysis. MLIT PDFs read via a fetch tool.
The full record
Every claim numbered to its source. Last updated .
Ransomware encrypted the one system that ran all five container terminals at Japan's largest port by tonnage; ships were worked by hand from paper while the gates stayed shut for about 60 hours. What is verified, what is only reported, and what is still unknown.
Summary
In July 2023, ransomware encrypted NUTS, the system shared by all five container terminals at the Port of Nagoya, Japan's largest port by tonnage. Container receiving and release stopped for about 60 hours, while ships were worked by hand from paper, with delays. No official document names the attacker; the LockBit name comes from press reports of the ransom note.1,2,5,6
Timeline of the Port of Nagoya incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
NUTS stops working. Asahi later reported, from interviews with the association, that the first symptom was trailers that could not be accepted at the Tobishima gate.1,6
A ransomware threat note is printed from the system's dedicated printer.1
The servers cannot be restarted. The association contacts the prefectural police.1
The association finds the physical server platform and all virtual servers encrypted.1
Press release: trailer container receiving and release suspended for the day; ship loading and unloading referred to the prime stevedores. An 18:00 update moves the recovery target back two hours.7
Malware is detected in the backup data. The same evening, Jiji Press reports that an English threat note naming itself LockBit reached a port company.1,5
Backup restore completes. A 07:45 notice says the system was restored at 07:30 and moves the restart to the afternoon.1,7
A network fault is cleared, and the restored backup data is checked against the physical yard inventory.1
Staggered restart: TCB at 15:00, NUCT at 16:30 and 17:20, NUTS WEB at 17:00, then NCB and Tobishima North and South at 18:15. The same day Toyota says it will stop its export-parts packaging lines on 7 July, Reuters reports.1,8
The association reports all five terminals on normal operations from 18:15 on 6 July. Toyota's packaging stops at four logistics centers, per a trade paper report of 8 July.7,9
Security vendor Dragos headlines the incident as an OT breach and relays media reports that LockBit 3.0 demanded a ransom for returning control.10
Asahi reports, from interviews with the association, that about 100 pages were printed, each headed "LockBit Black Ransomware".6
The association publishes its report: the note stated no ransom amount, it has not contacted the attackers, a vulnerability in remote connection equipment was confirmed, and no trace of external information leakage has been confirmed at present.1
The transport ministry's Committee on Information Security Measures at Container Terminals holds its first meeting.11
The committee issues Interim Summary 1, with its findings on the VPN, the backups and the manual ship-side handling.2
Final report: the infection route cannot be determined definitively, the VPN equipment is the appropriate view, and another route cannot be ruled out.4
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What was encrypted?
NUTS: its physical server platform and all virtual servers1
Verified
Were cranes or controllers reached?
Not on any record. No official document describes handling equipment or a controller being reached1,2,4
Verified (absent from the record)
How long were the gates shut?
About 60 hours, 06:30 on 4 July to 18:15 on 6 July 20231
Verified
Did ships keep moving?
Handled by hand from paper, with delays of up to about 24 hours; "it is said" no ship skipped the port2
Most likely the maintenance VPN; not determined definitively; another route not ruled out1,4
Not settled
Who was behind it?
No official document names a group. The LockBit name comes from press reports of the note5,6
Reported only
Was a ransom amount stated?
No. The note stated no amount, and the association has not contacted the attackers1
Verified
Did data leave?
No trace of external leakage confirmed as of 26 July 2023; investigation continuing1
Verified (time-bound)
Did Toyota halt production?
No. Export-parts packaging paused on 7 July; domestic vehicle production not affected, per a spokesperson8,9
Reported only
Who built and maintains NUTS?
Not named in any official document
Undisclosed
Incident cost
Not published
Undisclosed
Did the Port of Nagoya shut down completely?
No. The gates stopped; ship-side cargo handling continued by hand, with delays. The transport ministry's expert committee lists, among the things that went right, that cargo handling with ships continued by manual work from work instructions printed on paper. It gives the delay for the 37 affected vessels as up to about 24 hours, and says it is reported that no ship skipped Nagoya:2
In BlastWave's translation: because cargo handling continued on the basis of work instructions printed on paper, it is said that no ship skipped the Port of Nagoya. The sentence ends in とされている ("it is said"), and that hedge stays. What stopped, for about three days, was containers going in and out through the gates (搬入・搬出).2
The operator's own account was blunter. The association's 26 July report says work at all terminals in the port was forced to stop, and its 5 July release suspended trailer container receiving and release and referred ship loading and unloading to the prime stevedores.1,7 The ministry's account, two months later, is the fuller record. How much cargo moved by hand is not stated anywhere.
In BlastWave's translation: the response was possible this time because people experienced in the manual work from before computerization were there, and there is also the view that preparing on the premise of doing all work manually is unrealistic. The closing phrase (との指摘もある) records a view; it is not presented as the committee's own finding.2 The final report adds that a business continuity plan for disasters existed but none for a system failure, and recommends arranging procedures for cargo handling without the system in advance, as needed.4
Were the port's cranes or control systems hacked?
No record says so. What was encrypted was NUTS, the terminal operating system that all five container terminals and the centralized gate share. The association found its physical server platform and all of its virtual servers encrypted.1,2 Neither the association's report nor any of the ministry committee's materials describes a crane, a straddle carrier, any handling equipment or any controller being reached.1,2,4
Hackopedia places Nagoya on the rung of IT compromise halting physical operations. That NUTS is the planning layer that tells terminals which box goes where, rather than the layer that runs machines, is BlastWave's reading: the ministry describes it as managing container handling and logistics, and no document describes it controlling cranes. When it stopped, the machines were fine and nobody could tell them what to do.
How did the attackers get into the Port of Nagoya's system?
Most likely through a maintenance VPN, in the ministry committee's view, but the route has never been determined definitively. In July the association wrote:1
"リモート接続機器の脆弱性が確認されており、そこから不正なアクセスを受けたと考えられます"
In BlastWave's translation: a vulnerability in remote connection equipment has been confirmed, and unauthorized access is believed to have come from there. In September the ministry committee reported that the NUTS maintenance VPN had no IP address restriction, so anyone on the internet with a matching ID and password could reach it, and that vulnerabilities in the VPN device and the physical servers had been public for months and not addressed.2
Its final report of 24 January 2024 carries three clauses that belong together: the infection route cannot be determined definitively; it is appropriate to view it as an intrusion from the VPN equipment; and compromise by another route cannot be ruled out. The logs were encrypted along with everything else.4
"VPN経由以外での侵害の可能性についても否定することはできない"
Which vulnerabilities were used, and which companies developed and maintain NUTS, are not named in any official document.
Was LockBit behind the Port of Nagoya ransomware incident?
No official document names a group. The LockBit name comes from the ransom note, as reported by the press. Jiji Press reported on 5 July 2023 that an English threat note naming itself the Russia-based group LockBit reached a port company, and on 6 July that the message contained a demand for money in exchange for restoring the system.5 Asahi, from interviews with the association, reported on 12 July 2023 that about 100 pages were printed, each headed "LockBit Black Ransomware", the LockBit 3.0 build.6
The victim's own report names no group, and says this about the note:
"脅迫文に身代金額の記載はなく、攻撃者への連絡も行っておりません"
In BlastWave's translation: the threat note stated no ransom amount, and we have not contacted the attackers. The accurate description is "claimed by" LockBit, tied to the note. Because the note came out of the victim's own printer, it is among the strongest evidence of its kind in Hackopedia, and it is still a claim, not an attribution. None of the records we read says a ransom was paid.1,5,6
Why did it take about 60 hours to reopen the gates?
Every server was encrypted, and the backups carried the malware. The association found the malware in its backup data at about 21:00 on 5 July, so the backups had to be cleaned before they could be used.1 The ministry committee found that backups covered only the latest three days and only the production environment.2
The restore completed at about 07:15 on 6 July. A network fault followed, cleared at about 14:15, and before reopening the association checked the restored data against what was physically sitting in the yard. The first terminal restarted at 15:00 and the last three at 18:15, just under 60 hours after NUTS stopped.1
The ministry committee also lists what the operator did well: a relationship with the prefectural police built beforehand through cybersecurity training and similar settings, a terminal section that functioned as the de facto decision body, and recovery in a full two and a half days (丸2日半).2 The association's public notices record its own missed restart targets.7
What is still not known about Port of Nagoya
How the attacker got in. The ministry committee cannot determine the route definitively and cannot rule out another route, because the logs were encrypted too.4
Which vulnerabilities were used.
Who carried out the intrusion. No official document names a group; the LockBit name rests on press reports of the note.5,6
Which companies developed and maintain NUTS. They are unnamed in every official document read.
How much cargo moved by hand while the system was down.
What the incident cost.
Whether any data left. The association found no trace of external information leakage as of 26 July 2023 and said it would keep investigating; no later finding appears in the record we read.1
Claims about Port of Nagoya the record does not support
Widely repeated claim
What the record says
"OT Cybersecurity Breach Disrupts Operations at the Port of Nagoya, Japan"; "Japanese media reported that LockBit was the ransomware variant used in the attack and that the hacker group, LockBit 3.0, demanded a ransom for returning control of the system."
No crane, handling equipment or controller is on any record; NUTS, a terminal operating system, was encrypted. The victim says the note stated no ransom amount and that it has not contacted the attackers, and no official document names a group. The same vendor post dates the attack 5 July (NUTS stopped on 4 July) and misnames the port's operator.1,2,10
"LockBit attacked the Port of Nagoya."
Claimed by LockBit through the note, as reported by the press. Neither the association nor the transport ministry names a group.1,5,6
"Nagoya is Japan's largest container port."
It is Japan's largest port by total cargo tonnage. By foreign trade containers the port authority ranks it third in Japan.3
"Toyota halted production."
Toyota paused export-parts packaging at four logistics centers on 7 July, the day after the port reopened, and a spokesperson said domestic vehicle production was not affected.8,9
What did Japan's government do after the incident?
The transport ministry convened an expert committee, which reported between September 2023 and January 2024. The Committee on Information Security Measures at Container Terminals met on 31 July, 29 September and 30 November 2023 and 24 January 2024, with a further meeting on 21 November 2024.11
Its final report recommends institutional measures under the Port Transportation Business Act, the Cybersecurity Basic Act and the Economic Security Promotion Act, including bringing container terminal operating system operators within their scope.4 Whether and when those measures took effect has not been verified for this entry. No government security advisory for the incident appears in the record we read.
BlastWave analysis: the fallback lived in people, not in a plan
Analysis, not a disclosed fact
The easy reading of Nagoya is that the port had no manual mode and stopped dead. The record says otherwise, and the difference is the lesson. The quay had a fallback: crews worked ships from paper, with delays. The gate had none. The ministry committee's own qualifier explains why the quay could do it: people who had done the job before computerization were still there. The fallback existed, but it lived in people, not in a plan, and a fallback that lives in memory shrinks every time someone retires. That reading, and the view that the gate needed its own designed manual path, are BlastWave's analysis, not disclosed facts.2
The operator acted well: a police relationship built before the incident, a terminal section working as the de facto decision body, a public timeline that records its own missed targets, and a check of restored data against the physical yard before reopening.1,2,7 What made it about 60 hours was set long before July: a maintenance VPN that any internet address could reach with a matching ID and password, and backups that covered three days, production only, and carried the malware.2
Podcast: “The Coat Check” (8:58). Joe Baxter and Cam Cullen on why the quay could go by hand and the gate could not.
Video: Port of Nagoya Short (60 to 90 seconds).
Frequently asked questions
What happened at the Port of Nagoya in July 2023?
At about 06:30 on 4 July 2023, NUTS, the single terminal operating system shared by all five container terminals at the Port of Nagoya, stopped, and a ransomware threat note printed from the system's own printer about an hour later. The Nagoya Harbor Transportation Association found every server encrypted and, the next night, malware in its backups. Container receiving and release stopped until 18:15 on 6 July, about 60 hours.
Did the whole Port of Nagoya shut down?
Not entirely, according to Japan's transport ministry. Its expert committee's interim summary of 29 September 2023 says cargo handling with ships continued by hand from instructions printed on paper, with delays of up to about 24 hours, and that it is said no ship skipped the port. What stopped for about three days was containers moving through the gates. The association's own July letters said work at all terminals had to stop.
Was LockBit behind the Port of Nagoya ransomware incident?
No official document names a group: neither the association's report of 26 July 2023 nor any transport ministry document does. The LockBit name comes from the press. Jiji Press reported on 5 July 2023 that an English note naming itself LockBit reached a port company, and Asahi reported on 12 July that the printed pages were headed "LockBit Black Ransomware." It is a claim made through the note, not an attribution.
How did the attackers get into the Port of Nagoya's system?
The transport ministry committee's final report of 24 January 2024 says the infection route cannot be determined definitively, that it is appropriate to view it as an intrusion through the maintenance VPN equipment, and that compromise by another route cannot be ruled out. Its September 2023 interim summary found the VPN had no IP address restriction, so anyone with a matching ID and password could reach it.
Was a ransom demanded or paid at the Port of Nagoya?
The Nagoya Harbor Transportation Association said in its report of 26 July 2023 that the threat note stated no ransom amount and that it had not contacted the attackers. Jiji Press reported on 6 July 2023 that the message contained a demand for money in exchange for restoring the system. None of the records Hackopedia read says a ransom was paid.
Were the Port of Nagoya's cranes or OT systems hacked?
No official record says so. What was encrypted was NUTS, the terminal operating system the five container terminals share; the association found its physical server platform and all virtual servers encrypted. Neither the association's July 2023 report nor the transport ministry committee's materials describe any crane, handling equipment or controller being reached. Hackopedia classes it as an IT compromise that halted physical operations.
Did the Port of Nagoya incident stop Toyota's production?
No. Reuters reported on 6 July 2023 that Toyota would stop its export-parts packaging lines on 7 July, the day after the port reopened, and a spokesperson said domestic vehicle production was not affected. The trade paper Nikkan Jidosha Shimbun reported on 8 July that four logistics centers were stopped. This is separate from the 2022 supplier incident that stopped Toyota's plants.
Is the Port of Nagoya Japan's largest container port?
No. The Nagoya Port Authority says Nagoya has been first in Japan by total cargo tonnage for more than two decades, but by foreign trade containers the same authority ranks it third in Japan. Calling Nagoya Japan's largest port is accurate only by tonnage, and the July 2023 incident hit its container terminals, where the largest label does not apply.
Primary sources are the Nagoya Harbor Transportation Association's own report and notices, the Japanese transport ministry committee's published materials and the port authority's statistics. Japanese titles are kept with an English gloss, and quotations are BlastWave's translations. Press and vendor posts are cited only as evidence of what was said.
CompanyNagoya Harbor Transportation Association (名古屋港運協会), Nagoya Container Committee, Terminal Section, "NUTSシステム障害の経緯報告" (Report on the course of the NUTS system failure), to container terminal users, 26 July 2023, 2 pp. Japanese. PDF
GovernmentMinistry of Land, Infrastructure, Transport and Tourism (MLIT), Committee on Information Security Measures at Container Terminals, "中間取りまとめ①" (Interim Summary 1), Material 1-3, second meeting, 29 September 2023. Japanese. PDF
GovernmentNagoya Port Authority (名古屋港管理組合), "名古屋港の実力" (The capabilities of the Port of Nagoya), port statistics page. Japanese. port-of-nagoya.jp
GovernmentMLIT, Committee on Information Security Measures at Container Terminals, "取りまとめ" (Final report), fourth meeting, 24 January 2024. Japanese. PDF
PressJiji Press, report of an English threat note naming itself LockBit, 5 July 2023, 21:58 JST, and follow-up report, 6 July 2023 (Japanese and English editions). Cited as evidence of what was said.
PressAsahi Shimbun, report from interviews with the Nagoya Harbor Transportation Association, 12 July 2023. Japanese. Cited as evidence of what was said. asahi.com
CompanyNagoya Harbor Transportation Association, notices to the press and terminal users: 5 July 2023 (12:00 press release and 18:00 update), 6 July 2023 (07:45) and 7 July 2023. Japanese. 5 July release (PDF)
PressReuters (Japanese service), report that Toyota would stop its export-parts packaging lines on 7 July, 6 July 2023. Japanese. Cited as evidence of what was said.
PressNikkan Jidosha Shimbun (日刊自動車新聞), "トヨタ、名古屋港のシステム障害で輸出向け部品を梱包する物流センター4拠点を停止 完成車生産への影響なし" (Toyota stops four logistics centers that pack export parts over the Nagoya port system failure; no effect on finished-vehicle production), 8 July 2023. Japanese. Cited as evidence of what was said. netdenjd.com
ResearcherDragos, "OT Cybersecurity Breach Disrupts Operations at the Port of Nagoya, Japan," blog, 11 July 2023. Cited as evidence of what was said. dragos.com
GovernmentMLIT, committee page for the Committee on Information Security Measures at Container Terminals, listing the meetings of 31 July, 29 September and 30 November 2023, 24 January 2024 and 21 November 2024, with "中間取りまとめ②" (Interim Summary 2), 30 November 2023. Japanese. mlit.go.jp
Cite this page
BlastWave. “Port of Nagoya Ransomware Incident (2023): What Is Verified.” Hackopedia, Volume 2, FILE 045. Last verified 28 September 2026. https://hackopedia.blastwave.com/transportation-logistics/port-of-nagoya-2023/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 045 in Hackopedia Volume 2, in the Transportation and Logistics edition.
28 Sep 2026
Hand-check: the four Toyota logistics centers were confirmed in the originally cited trade paper, Nikkan Jidosha Shimbun, dated 8 July 2023. A daily container-volume figure that could not be traced to a primary source was kept off the page. Cross-checked against the Toyota, DP World and Collins Aerospace entries for consistency.
26 Sep 2026
Full validation. The association's 26 July report and its 5, 6 and 7 July notices were read in full, and the ministry committee's materials re-read sentence by sentence. Corrected: the "LockBit Black Ransomware" header is attributed to Asahi (12 July 2023), not Jiji; the manual ship-side handling now carries the ministry's delay of up to about 24 hours and the association's own statement that work at all terminals had to stop; data leakage is stated as no trace found as of 26 July rather than unknown; the "unrealistic" sentence is presented as a view the committee records, not its own finding; and the VPN is described as reachable with a matching ID and password.
24 Sep 2026
Volume 2 entry built from primary sources: the operator's own report, the transport ministry committee's published materials and the port authority's statistics.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
