Data through 2026-11-08 (8 November 2026)
Search

Cyberattack on Transnet disrupts South African container terminals

Cyberattack on Transnet disrupts South African container terminals. The disruption ran from 2021-07-22 (22 July 2021) to 2021-08-02 (2 August 2021), 12 days, affecting Durban, Cape Town, Ngqura, Port Elizabeth. Durban averaged 1.0 calls per day during the event window against an expected 1.9 (-0.9). Cape Town averaged 1.1 calls per day during the event window against an expected 1.1 (0.0). Ngqura averaged 0.5 calls per day during the event window against an expected 0.9 (-0.4). Port Elizabeth averaged 0.3 calls per day during the event window against an expected 0.3 (+0.1).

World Freight Monitor permanent record. https://worldfreightmonitor.com/events/2021/cyberattack-transnet-ports-south-africa-2021/. Record last updated 2026-10-08.

Key facts

Started
2021-07-22 (22 July 2021)
Ended
2021-08-02 (2 August 2021)
Status
ended
Severity
2 Moderate
Scope
regional
Chokepoints
None
Lanes
None
Countries
South Africa
Confidence
medium: The dates of the attack, the force majeure and its uplift are consistent across four outlets quoting Transnet Port Terminals, but Transnet's own statements from 2021 are no longer available on its site and could not be cited directly.
First reported
2021-07-27 (27 July 2021)
  • Severity basis: Container handling at four ports ran on manual systems for more than 72 hours, with force majeure in place from 2021-07-26 until it was uplifted with effect from 2021-08-02.

What happened

A cyberattack on the South African state logistics company Transnet from 2021-07-22 (22 July 2021) disrupted the systems that run its container terminals. Transnet Port Terminals declared force majeure on 2021-07-26 at the container terminals in Durban, Cape Town, Ngqura and Port Elizabeth, where loading and discharge switched to manual processes and ran more slowly than normal. Transnet Port Terminals described the incident as "an act of cyber-attack, security intrusion and sabotage". The terminal operating system was restored in stages, and Transnet said the force majeure would be uplifted with effect from 2021-08-02 once it could meet its contractual obligations again. Transnet did not name an attacker. A cybersecurity firm reported that a ransom note left on Transnet systems matched a known ransomware family.

Measured effect

Container ship port calls, Durban

Baseline (expected)
1.9 calls per day
Observed
1.0 calls per day
Change
-0.9 (percent omitted, baseline too small)
Standardised score
-0.6
Event window
2021-07-22 to 2021-08-02 (12 days)
Baseline window
2021-05-20 to 2021-07-14 (56 valid days)
Method
wfm-effect-1.0
Computed
2026-09-19 (19 September 2026), data revision 1:ac663e6ec2f8
Container ship port calls, DurbanContainer ship port calls, Durban, 2021-05-13 (13 May 2021) to 2021-09-13 (13 September 2021): values ranged from 0 calls per day on 2021-05-13 to 4 calls per day on 2021-07-02, with a mean of 1.6 calls per day. The latest value, for 2021-09-13, was 1 calls per day. The shaded band marks the event window, 2021-07-22 to 2021-08-02.012342021-05-132021-07-142021-09-13
Container ship port calls, Durban, 2021-05-13 (13 May 2021) to 2021-09-13 (13 September 2021): values ranged from 0 calls per day on 2021-05-13 to 4 calls per day on 2021-07-02, with a mean of 1.6 calls per day. The latest value, for 2021-09-13, was 1 calls per day. The shaded band marks the event window, 2021-07-22 to 2021-08-02.

Source: IMF PortWatch (portwatch.imf.org), International Monetary Fund, using UN Global Platform AIS data. Statistics derived by World Freight Monitor. Terms. Retrieved 2026-11-10 (10 November 2026).

Container ship port calls, Durban (calls per day).
Datecalls per day
2021-05-130
2021-05-142
2021-05-153
2021-05-163
2021-05-172
2021-05-181
2021-05-192
2021-05-203
2021-05-212
2021-05-222
2021-05-233
2021-05-243
2021-05-251
2021-05-263
2021-05-273
2021-05-280
2021-05-292
2021-05-302
2021-05-312
2021-06-011
2021-06-023
2021-06-031
2021-06-041
2021-06-053
2021-06-062
2021-06-073
2021-06-082
2021-06-091
2021-06-101
2021-06-112
2021-06-121
2021-06-132
2021-06-142
2021-06-152
2021-06-161
2021-06-173
2021-06-181
2021-06-193
2021-06-201
2021-06-211
2021-06-222
2021-06-233
2021-06-242
2021-06-252
2021-06-260
2021-06-273
2021-06-281
2021-06-291
2021-06-303
2021-07-011
2021-07-024
2021-07-030
2021-07-042
2021-07-052
2021-07-063
2021-07-071
2021-07-081
2021-07-092
2021-07-102
2021-07-111
2021-07-120
2021-07-130
2021-07-140
2021-07-151
2021-07-163
2021-07-172
2021-07-181
2021-07-190
2021-07-202
2021-07-211
2021-07-220
2021-07-231
2021-07-241
2021-07-250
2021-07-261
2021-07-272
2021-07-281
2021-07-291
2021-07-301
2021-07-312
2021-08-010
2021-08-022
2021-08-030
2021-08-042
2021-08-052
2021-08-062
2021-08-070
2021-08-082
2021-08-091
2021-08-103
2021-08-112
2021-08-121
2021-08-130
2021-08-142
2021-08-153
2021-08-161
2021-08-172
2021-08-182
2021-08-191
2021-08-202
2021-08-212
2021-08-224
2021-08-230
2021-08-240
2021-08-252
2021-08-260
2021-08-272
2021-08-280
2021-08-291
2021-08-301
2021-08-312
2021-09-012
2021-09-021
2021-09-031
2021-09-041
2021-09-050
2021-09-064
2021-09-071
2021-09-081
2021-09-092
2021-09-101
2021-09-110
2021-09-123
2021-09-131

This is a measured change in public data during the event window, compared with a baseline before it. It shows timing, not cause. We describe an event as causing a change only when an official source says so.

Container ship port calls, Cape Town

Baseline (expected)
1.1 calls per day
Observed
1.1 calls per day
Change
0.0 (percent omitted, baseline too small)
Standardised score
0.0
Event window
2021-07-22 to 2021-08-02 (12 days)
Baseline window
2021-05-20 to 2021-07-14 (56 valid days)
Method
wfm-effect-1.0
Computed
2026-09-19 (19 September 2026), data revision 1:445a8679a803
Container ship port calls, Cape TownContainer ship port calls, Cape Town, 2021-05-13 (13 May 2021) to 2021-09-13 (13 September 2021): values ranged from 0 calls per day on 2021-05-13 to 3 calls per day on 2021-05-14, with a mean of 1.2 calls per day. The latest value, for 2021-09-13, was 0 calls per day. The shaded band marks the event window, 2021-07-22 to 2021-08-02.01232021-05-132021-07-142021-09-13
Container ship port calls, Cape Town, 2021-05-13 (13 May 2021) to 2021-09-13 (13 September 2021): values ranged from 0 calls per day on 2021-05-13 to 3 calls per day on 2021-05-14, with a mean of 1.2 calls per day. The latest value, for 2021-09-13, was 0 calls per day. The shaded band marks the event window, 2021-07-22 to 2021-08-02.

Source: IMF PortWatch (portwatch.imf.org), International Monetary Fund, using UN Global Platform AIS data. Statistics derived by World Freight Monitor. Terms. Retrieved 2026-11-10 (10 November 2026).

Container ship port calls, Cape Town (calls per day).
Datecalls per day
2021-05-130
2021-05-143
2021-05-150
2021-05-161
2021-05-172
2021-05-181
2021-05-193
2021-05-201
2021-05-210
2021-05-221
2021-05-232
2021-05-241
2021-05-252
2021-05-262
2021-05-272
2021-05-281
2021-05-291
2021-05-301
2021-05-312
2021-06-011
2021-06-023
2021-06-032
2021-06-041
2021-06-050
2021-06-061
2021-06-072
2021-06-081
2021-06-092
2021-06-101
2021-06-111
2021-06-120
2021-06-130
2021-06-142
2021-06-152
2021-06-163
2021-06-171
2021-06-181
2021-06-190
2021-06-201
2021-06-211
2021-06-220
2021-06-230
2021-06-240
2021-06-250
2021-06-262
2021-06-272
2021-06-280
2021-06-290
2021-06-301
2021-07-010
2021-07-021
2021-07-030
2021-07-041
2021-07-052
2021-07-060
2021-07-072
2021-07-081
2021-07-090
2021-07-103
2021-07-111
2021-07-120
2021-07-133
2021-07-141
2021-07-152
2021-07-162
2021-07-170
2021-07-181
2021-07-191
2021-07-202
2021-07-210
2021-07-220
2021-07-232
2021-07-242
2021-07-252
2021-07-261
2021-07-271
2021-07-280
2021-07-290
2021-07-303
2021-07-310
2021-08-012
2021-08-020
2021-08-033
2021-08-040
2021-08-051
2021-08-061
2021-08-070
2021-08-083
2021-08-090
2021-08-102
2021-08-111
2021-08-122
2021-08-130
2021-08-141
2021-08-153
2021-08-161
2021-08-171
2021-08-182
2021-08-191
2021-08-201
2021-08-212
2021-08-221
2021-08-233
2021-08-242
2021-08-251
2021-08-262
2021-08-270
2021-08-281
2021-08-290
2021-08-301
2021-08-310
2021-09-011
2021-09-022
2021-09-031
2021-09-040
2021-09-051
2021-09-063
2021-09-071
2021-09-081
2021-09-093
2021-09-100
2021-09-113
2021-09-122
2021-09-130

This is a measured change in public data during the event window, compared with a baseline before it. It shows timing, not cause. We describe an event as causing a change only when an official source says so.

Container ship port calls, Ngqura

Baseline (expected)
0.9 calls per day
Observed
0.5 calls per day
Change
-0.4 (percent omitted, baseline too small)
Standardised score
-0.4
Event window
2021-07-22 to 2021-08-02 (12 days)
Baseline window
2021-05-20 to 2021-07-14 (56 valid days)
Method
wfm-effect-1.0
Computed
2026-09-19 (19 September 2026), data revision 1:7f673891853d
Container ship port calls, NgquraContainer ship port calls, Ngqura, 2021-05-13 (13 May 2021) to 2021-09-13 (13 September 2021): values ranged from 0 calls per day on 2021-05-15 to 3 calls per day on 2021-05-14, with a mean of 0.9 calls per day. The latest value, for 2021-09-13, was 1 calls per day. The shaded band marks the event window, 2021-07-22 to 2021-08-02.01232021-05-132021-07-142021-09-13
Container ship port calls, Ngqura, 2021-05-13 (13 May 2021) to 2021-09-13 (13 September 2021): values ranged from 0 calls per day on 2021-05-15 to 3 calls per day on 2021-05-14, with a mean of 0.9 calls per day. The latest value, for 2021-09-13, was 1 calls per day. The shaded band marks the event window, 2021-07-22 to 2021-08-02.

Source: IMF PortWatch (portwatch.imf.org), International Monetary Fund, using UN Global Platform AIS data. Statistics derived by World Freight Monitor. Terms. Retrieved 2026-11-10 (10 November 2026).

Container ship port calls, Ngqura (calls per day).
Datecalls per day
2021-05-131
2021-05-143
2021-05-150
2021-05-161
2021-05-171
2021-05-180
2021-05-192
2021-05-202
2021-05-210
2021-05-221
2021-05-230
2021-05-242
2021-05-250
2021-05-263
2021-05-271
2021-05-281
2021-05-291
2021-05-302
2021-05-311
2021-06-012
2021-06-020
2021-06-033
2021-06-041
2021-06-051
2021-06-060
2021-06-071
2021-06-081
2021-06-091
2021-06-100
2021-06-110
2021-06-122
2021-06-132
2021-06-140
2021-06-152
2021-06-161
2021-06-170
2021-06-182
2021-06-190
2021-06-202
2021-06-211
2021-06-220
2021-06-232
2021-06-241
2021-06-252
2021-06-260
2021-06-270
2021-06-280
2021-06-291
2021-06-302
2021-07-011
2021-07-020
2021-07-031
2021-07-040
2021-07-052
2021-07-060
2021-07-071
2021-07-081
2021-07-092
2021-07-101
2021-07-111
2021-07-121
2021-07-130
2021-07-142
2021-07-151
2021-07-160
2021-07-171
2021-07-180
2021-07-191
2021-07-202
2021-07-210
2021-07-220
2021-07-230
2021-07-242
2021-07-251
2021-07-260
2021-07-271
2021-07-280
2021-07-290
2021-07-300
2021-07-311
2021-08-011
2021-08-020
2021-08-031
2021-08-040
2021-08-052
2021-08-061
2021-08-071
2021-08-080
2021-08-091
2021-08-100
2021-08-111
2021-08-121
2021-08-131
2021-08-140
2021-08-150
2021-08-163
2021-08-170
2021-08-181
2021-08-191
2021-08-201
2021-08-211
2021-08-221
2021-08-230
2021-08-242
2021-08-251
2021-08-262
2021-08-271
2021-08-281
2021-08-290
2021-08-301
2021-08-310
2021-09-012
2021-09-022
2021-09-031
2021-09-041
2021-09-050
2021-09-062
2021-09-071
2021-09-081
2021-09-090
2021-09-101
2021-09-110
2021-09-121
2021-09-131

This is a measured change in public data during the event window, compared with a baseline before it. It shows timing, not cause. We describe an event as causing a change only when an official source says so.

Container ship port calls, Port Elizabeth

Baseline (expected)
0.3 calls per day
Observed
0.3 calls per day
Change
+0.1 (percent omitted, baseline too small)
Standardised score
+0.1
Event window
2021-07-22 to 2021-08-02 (12 days)
Baseline window
2021-05-20 to 2021-07-14 (56 valid days)
Method
wfm-effect-1.0
Computed
2026-09-19 (19 September 2026), data revision 1:2abdd20258a5
Container ship port calls, Port ElizabethContainer ship port calls, Port Elizabeth, 2021-05-13 (13 May 2021) to 2021-09-13 (13 September 2021): values ranged from 0 calls per day on 2021-05-13 to 2 calls per day on 2021-06-01, with a mean of 0.5 calls per day. The latest value, for 2021-09-13, was 1 calls per day. The shaded band marks the event window, 2021-07-22 to 2021-08-02.0.00.51.01.52.02021-05-132021-07-142021-09-13
Container ship port calls, Port Elizabeth, 2021-05-13 (13 May 2021) to 2021-09-13 (13 September 2021): values ranged from 0 calls per day on 2021-05-13 to 2 calls per day on 2021-06-01, with a mean of 0.5 calls per day. The latest value, for 2021-09-13, was 1 calls per day. The shaded band marks the event window, 2021-07-22 to 2021-08-02.

Source: IMF PortWatch (portwatch.imf.org), International Monetary Fund, using UN Global Platform AIS data. Statistics derived by World Freight Monitor. Terms. Retrieved 2026-11-10 (10 November 2026).

Container ship port calls, Port Elizabeth (calls per day).
Datecalls per day
2021-05-130
2021-05-141
2021-05-151
2021-05-161
2021-05-170
2021-05-181
2021-05-190
2021-05-200
2021-05-210
2021-05-220
2021-05-230
2021-05-240
2021-05-251
2021-05-260
2021-05-270
2021-05-281
2021-05-290
2021-05-301
2021-05-310
2021-06-012
2021-06-021
2021-06-030
2021-06-041
2021-06-050
2021-06-061
2021-06-070
2021-06-081
2021-06-090
2021-06-100
2021-06-110
2021-06-121
2021-06-131
2021-06-140
2021-06-150
2021-06-160
2021-06-170
2021-06-181
2021-06-191
2021-06-201
2021-06-210
2021-06-221
2021-06-230
2021-06-240
2021-06-250
2021-06-261
2021-06-270
2021-06-280
2021-06-291
2021-06-301
2021-07-011
2021-07-020
2021-07-030
2021-07-040
2021-07-051
2021-07-060
2021-07-070
2021-07-080
2021-07-090
2021-07-102
2021-07-110
2021-07-121
2021-07-130
2021-07-141
2021-07-151
2021-07-160
2021-07-170
2021-07-180
2021-07-190
2021-07-201
2021-07-212
2021-07-220
2021-07-230
2021-07-240
2021-07-251
2021-07-260
2021-07-271
2021-07-280
2021-07-290
2021-07-300
2021-07-311
2021-08-010
2021-08-021
2021-08-030
2021-08-040
2021-08-051
2021-08-060
2021-08-070
2021-08-081
2021-08-090
2021-08-101
2021-08-111
2021-08-120
2021-08-131
2021-08-140
2021-08-151
2021-08-160
2021-08-170
2021-08-182
2021-08-190
2021-08-201
2021-08-212
2021-08-221
2021-08-230
2021-08-241
2021-08-250
2021-08-260
2021-08-271
2021-08-281
2021-08-290
2021-08-301
2021-08-310
2021-09-011
2021-09-020
2021-09-031
2021-09-040
2021-09-051
2021-09-061
2021-09-071
2021-09-080
2021-09-090
2021-09-100
2021-09-111
2021-09-120
2021-09-131

This is a measured change in public data during the event window, compared with a baseline before it. It shows timing, not cause. We describe an event as causing a change only when an official source says so.

Replay

Replay: Container ship port calls, DurbanContainer ship port calls, Durban, 2021-05-23 (23 May 2021) to 2021-08-21 (21 August 2021): values ranged from 0 calls per day on 2021-05-28 to 4 calls per day on 2021-07-02. The shaded band marks the event window, 2021-07-22 to 2021-08-02.012342021-05-232021-08-21
Container ship port calls, Durban, 2021-05-23 (23 May 2021) to 2021-08-21 (21 August 2021): values ranged from 0 calls per day on 2021-05-28 to 4 calls per day on 2021-07-02. The shaded band marks the event window, 2021-07-22 to 2021-08-02.

Source: IMF PortWatch (portwatch.imf.org), International Monetary Fund, using UN Global Platform AIS data. Statistics derived by World Freight Monitor. Terms. Retrieved 2026-11-10 (10 November 2026).

Container ship port calls, Durban (calls per day), daily values shown in the replay.
Datecalls per day
2021-05-233
2021-05-243
2021-05-251
2021-05-263
2021-05-273
2021-05-280
2021-05-292
2021-05-302
2021-05-312
2021-06-011
2021-06-023
2021-06-031
2021-06-041
2021-06-053
2021-06-062
2021-06-073
2021-06-082
2021-06-091
2021-06-101
2021-06-112
2021-06-121
2021-06-132
2021-06-142
2021-06-152
2021-06-161
2021-06-173
2021-06-181
2021-06-193
2021-06-201
2021-06-211
2021-06-222
2021-06-233
2021-06-242
2021-06-252
2021-06-260
2021-06-273
2021-06-281
2021-06-291
2021-06-303
2021-07-011
2021-07-024
2021-07-030
2021-07-042
2021-07-052
2021-07-063
2021-07-071
2021-07-081
2021-07-092
2021-07-102
2021-07-111
2021-07-120
2021-07-130
2021-07-140
2021-07-151
2021-07-163
2021-07-172
2021-07-181
2021-07-190
2021-07-202
2021-07-211
2021-07-220
2021-07-231
2021-07-241
2021-07-250
2021-07-261
2021-07-272
2021-07-281
2021-07-291
2021-07-301
2021-07-312
2021-08-010
2021-08-022
2021-08-030
2021-08-042
2021-08-052
2021-08-062
2021-08-070
2021-08-082
2021-08-091
2021-08-103
2021-08-112
2021-08-121
2021-08-130
2021-08-142
2021-08-153
2021-08-161
2021-08-172
2021-08-182
2021-08-191
2021-08-202
2021-08-212

This is a measured change in public data during the event window, compared with a baseline before it. It shows timing, not cause. We describe an event as causing a change only when an official source says so.

Timeline

  1. Transnet systems are disrupted by a cyberattack, affecting IT applications used across the company and the terminal operating system at its container terminals. [s1] [s2] [s5] [s6]
  2. Transnet Port Terminals declares force majeure at the container terminals in Durban, Cape Town, Ngqura and Port Elizabeth, and moves container handling onto manual systems. [s1] [s2]
  3. A cybersecurity firm reports that a ransom note left on Transnet computers is linked to a ransomware family known as Death Kitty, Hello Kitty and Five Hands. Transnet does not attribute the attack. [s4]
  4. Transnet says operations have normalised after the terminal operating system was restored in stages and that the force majeure will be uplifted with effect from the following day. [s3]
  5. The force majeure declared at the four container terminals is uplifted. [s3]

Cause

Transnet Port Terminals said it had experienced "an act of cyber-attack, security intrusion and sabotage" that disrupted its normal processes. A cybersecurity firm reported that a ransom note found on Transnet systems was linked to a known ransomware family. Transnet did not publicly identify those responsible. Attributed by: Transnet Port Terminals, with the ransomware link attributed by the cybersecurity firm CrowdStrike. [s1] [s4] [s6]

Resolution

2021-08-02 (2 August 2021): Transnet restored the terminal operating system in stages across the container terminals, said operations had normalised and uplifted the force majeure with effect from 2021-08-02. [s3] [s5]

Corrections

  • 2026-10-08 (8 October 2026): Added two official sources (s5 South African Government statement of 2021-07-29, s6 Transnet Annual Financial Statements 2021) and cited them on the 2021-07-22 timeline entry, the cause and the resolution. No date or figure was changed.. Reason: The record rested on press sources only. The government statement confirms the morning of 2021-07-22 and the staged restoration of the container terminal operating system; the Transnet report confirms the shutdown of systems.

Sources

  1. [s1] Moneyweb, Transnet cyber attack confirmed: Port terminals division declares force majeure, published 2021-07-27 (27 July 2021), accessed 2026-09-15. Archived copy. (press)
  2. [s2] The Maritime Executive, Second Force Majeure at South African Ports Following Cyberattack, published 2021-07-27 (27 July 2021), accessed 2026-09-15. Archived copy. (press)
  3. [s3] Daily Maverick, Transnet lifts force majeure on ports after operations normalise following cyberattack, published 2021-08-01 (1 August 2021), accessed 2026-09-15. Archived copy. (press)
  4. [s4] TechCentral, Transnet likely hit by Death Kitty ransomware attack, published 2021-07-29 (29 July 2021), accessed 2026-09-15. Archived copy. (press)
  5. [s5] South African Government (Department of Public Enterprises), Minister Pravin Gordhan commends Transnet for restoring full ports operations, published 2021-07-29 (29 July 2021), accessed 2026-10-04. Archived copy. (official)
  6. [s6] Transnet SOC Ltd, Annual Financial Statements 2021, accessed 2026-10-04. Archived copy. (official)

Cite this record

The address of this record is permanent and a correction is always logged on this page, so a citation names the version you read. Add the date you accessed it.

Plain text

World Freight Monitor. "Cyberattack on Transnet disrupts South African container terminals." Last updated 2026-10-08 (8 October 2026). https://worldfreightmonitor.com/events/2021/cyberattack-transnet-ports-south-africa-2021/

APA

World Freight Monitor. (2026). Cyberattack on Transnet disrupts South African container terminals. World Freight Monitor. https://worldfreightmonitor.com/events/2021/cyberattack-transnet-ports-south-africa-2021/

BibTeX

@misc{wfm_cyberattack_transnet_ports_south_africa_2021,
  author = {{World Freight Monitor}},
  title = {Cyberattack on Transnet disrupts South African container terminals},
  year = {2026},
  note = {Last updated 2026-10-08},
  url = {https://worldfreightmonitor.com/events/2021/cyberattack-transnet-ports-south-africa-2021/}
}