What happened

A group-wide cyberattack forced Transnet to shut down information systems and invoke business-continuity procedures across South Africa's port and freight network. Port terminals declared force majeure, container operations were disrupted, and staff used manual processes for incoming and outgoing ships and cargo movements. Government reporting said bulk, break-bulk and automotive operations — including coal, iron ore and manganese cargoes — switched immediately to manual handling. The main NAVIS N4 terminal system and normal port operations were restored by 29 July. Transnet described the event as a cyberattack, security intrusion and sabotage but did not publicly identify an attacker in the cited official material; this record therefore assigns no perpetrator or ransomware family.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.