Santos Port Confirms Cyberattack

Update November 11, 2026: the Santos Port Authority said the incident was tied at least in part to a power outage and identified which systems were affected. Brazil’s data protection authority, the ANPD, also began reviewing the documents sent by the port, alongside a Federal Police investigation.

The Santos Port Authority said its systems were hit by a cyberattack, leaving its website, internal platforms and services for customers and users partially or temporarily unavailable. Even so, port operations kept running normally, including vessel arrivals and departures and land access.

What happened to the port systems?

The disruption hit the port authority’s digital channels, but did not stop physical operations at the complex. According to the reporting cited, internet and phone service were restored on Monday, Nov. 9, while the port website and other internal systems were still unavailable. The agency said it used alternative service and control methods to keep operations running during the outage.

How did the port complex respond?

Cesportos-SP raised the security level at the Santos port complex to level II after the failures in the Santos Port Authority systems. The authority also reinforced the Port Guard teams and activated contingency procedures to maintain security and speed up access. Some services were sustained through alternative controls, including Porto Sem Papel, the federal system used to exchange information and documents between public agencies and port companies.

What is known about the investigation?

The Santos Port Authority said it still could not determine the full scope of the attack or whether data had been accessed. TV Globo reported that the incident may have started after a power outage on Friday, Nov. 6, and that the attack was discovered while systems were being restored, when encrypted data allegedly appeared. That sequence was not officially confirmed in the material available.

G1 later reported that the port authority attributed the incident, at least in part, to a power outage, and specified that the affected systems were the customer request protocol, Docas Digital, used for internal document processing, and SAP, used for administrative management. O Globo also reported that the ANPD had started reviewing the documentation submitted by the Santos Port Authority and could request additional clarification.

The Santos Port Authority also said there was no risk of a shutdown and that operations remained active. Urgente24 added that the Federal Police were investigating the case, while CBN said recovery was continuing gradually and the port was maintaining contingency measures. The case has led to tighter protection at Brazil’s largest port while work continues to measure the incident’s real impact.

What was reported about recovery?

Recovery was gradual and left some services under restrictions, although basic connectivity had already been restored. According to CBN, internet and phone service returned on Nov. 9, after three days without them, and the Santos Port Authority reinforced Port Guard teams to maintain security and speed up access.

During that process, CBN reported that encrypted data was found while systems were being restored, while the port website and part of the internal systems remained out of service. At the same time, the State Public Security Commission for Ports raised the access protection level preventively to two on a three-point scale.

What services kept working?

The port kept vessel traffic and land access moving, even though some administrative services may have experienced slowdowns or delays. Convergência Digital said the disruption affected the institutional website, internal systems and platforms used by companies and port users, but did not stop physical operations.

The agency also kept alternative controls in place to sustain activity while systems were restored. The scope of the incident and whether data were accessed remained under investigation.