The government does not yet know who was behind a cybersecurity incident that has shut down Australia’s second-largest port operator, and could affect freight in and out of the country for days. 

Key points:

DP World Australia — which operates ports in Melbourne, Sydney, Brisbane and Fremantle, and is responsible for 40 per cent of Australia’s maritime freight — closed after it began responding to a cybersecurity incident on Friday.

“The company, in collaboration with cybersecurity experts, has worked tirelessly, making significant progress in re-establishing landside freight operations at its ports,” DP World Australia said in a statement. 

It said it was collaborating “working closely with government and private sector stakeholders to identify and retrieve sensitive inbound freight” and held some concerns over the possible leaking of the companies’ private data. 

“A key line of inquiry in this ongoing investigation is the nature of data access and data theft. DP World Australia appreciates this development may cause concern for some stakeholders. DP World Australia is working hard to assess whether any personal information has been impacted and has taken proactive steps to engage the Office of the Australian Information Commissioner.”

It said its teams were “testing key systems crucial for the resumption of normal operations and regular freight movement” and it would provide a further update once testing was complete.

Home Affairs Minister Clare O’Neil took to X, formerly Twitter, to share a statement on the incident which she described as “serious and ongoing”. 

She added that managing cyber incidents of this kind is incredibly complex and she’s working with all relevant stakeholders in an effort to protect Australia’s interests and “working to ensure our ports and transport networks keep working while DP World resolves the incident”.

“This incident is a reminder of the serious risk that cyber attacks pose to our country, and to vital infrastructure we all rely on,” Ms O’Neil said. 

National Cyber Security Coordinator, Air Marshal Darren Goldie, with whom Ms O’Neil is working closely to resolve the issue, said the situation could take days to resolve, leading to significant freight delays.

He posted on social media site X on Sunday, saying the government was continuing to work with DP World Australia to resolve a “nationally significant cyber incident that has affected operations at a number of ports around the country”.

“DP World today advised the Australian Government that the time frame for interruptions to continue is likely to be a number of days, rather than weeks,” he said.

“While I understand there is interest in determining who may be responsible for the cyber incident, our primary focus at this time remains on resolving the incident and supporting DP World to restore their operations.”

Ports Australia released a statement on Sunday clarifying the close was only isolated to DP World terminals. 

“Australia’s ports and other terminals remain operational. We understand the importance of accurate reporting in maintaining public confidence and preventing unnecessary concern,” it said in a statement. 

The Australian Federal Police (AFP) said it was investigating the cybersecurity incident that forced port operators to suspend operations at ports in several states.

“We’ve commenced an investigation into the incident and we’re not commenting further as it’s an ongoing investigation,” an AFP spokesperson said.

The incident came days after Optus’ national outage caused chaos for Australians, though the company said the outage wasn’t related to cybersecurity.

Last month, the federal government released its first review into security risks faced by Australia’s critical infrastructure, including its telecommunications providers.

Deputy Prime Minister Richard Marles told Sky News on the weekend while he didn’t have the details of the attack, cybersecurity of Australia’s critical infrastructure had never been so important.

“The world that we are living in now is one where cybersecurity, in terms of our critical infrastructure, in fact, right through the private economy has never been more important,” he said. 

“It is a huge focus for us in what we do in terms of, in many respects, our national defences through the Australian Signals Directorate (ASD), but also the way in which, with ASD, we work with the private sector economy to bolster the cybersecurity of the private sector and that really applies in the case of areas of critical infrastructure.

“I mean, incidents like this just highlight how dependent we are upon the cyber realm and telecommunications and how important it is that we have as robust an ecosystem as possible.”