Santos Is Running on Paper, and Nobody Can Say What Happened

Santos Is Running on Paper, and Nobody Can Say What Happened

Santos, Brazil — The largest port in Latin America is moving cargo on paper this week. Its administrator says nothing has stopped. Its police force says it cannot yet confirm what happened. And twenty-five days before the systems went down, a criminal group had already published a claim naming a company inside this port.

The Notice That Never Loaded

The sequence, as the port authority tells it, begins with a power failure. Electricity faltered at the Autoridade Portuária de Santos on Friday morning, 6 November, and the servers went with it. Telephone and internet service across the administrative complex stayed dead for three days and were restored on Monday, 9 November. Full power did not return until Tuesday. Employees could not use the biometric readers at the gates until Tuesday either, and on Monday trucks backed up on the roads around the complex.

The port authority confirmed publicly on Tuesday that its systems had been the target of a cyberattack, four days after the first failure. What it has not done is explain how a power cut became a cyberattack, who did it, or what they took. Anderson Pomini, the authority's president, told TV Globo there was no danger to the waterfront: "The cargo arrives and leaves safely. Access to the quay is absolutely safe. What happened is that some administrative services were initially affected."

What the Authority Will Not Say

Read the authority's own statements closely and the uncertainty is deliberate. It said it has not been possible to determine the scope of the attack, whether data was accessed, or what the group behind it originally wanted. It said it had received no ransom demand. It said the recovery of systems is being carried out gradually and that there is no risk of paralysing port operations.

On Wednesday the authority added one new element: the power outage, it said, contributed to the cyberattack. That formulation confirms the two events are connected without saying whether the outage was a cause, a trigger, or a piece of luck for someone already inside the network. The authority's internal technology teams are working with specialists from Serpro, Brazil's federal data processing service, and backups have been handed over for forensic examination. For a company that publishes its own cargo statistics, the silence is the story.

Twenty-Five Days Earlier

On 12 October at 17:33 UTC, an extortion group calling itself n0n added thirty-eight port, terminal, shipping and logistics organisations to its dark-web leak site in a single batch. The list included Santos Brasil, Ocean Network Express, Pusan Newport Company, TTI Algeciras, Eurogate Tanger and NEOM Ports. Settlement demands reviewed by the security firm SOCRadar ranged from 2.4 million dollars to 14 million dollars, with a shared publication deadline of 19 October at 13:27 UTC.

n0n is new. It appeared in September 2026 and already holds eighty-five listings on the tracker kept by Ransomnews, which classifies it as a pure-extortion operation rather than a ransomware crew. Its documented route in is credentials harvested by infostealer malware. Brazilian outlets reported that the group had claimed the Port of Santos and set a ransom deadline that expired in early November. The port authority's systems went down twenty-five days after the listing, and eighteen days after the publication deadline.

Two Companies, One Confused Headline

Here is the distinction that has been flattened in most of the coverage. Santos Brasil is not the port authority. Santos Brasil is a private terminal operator that runs container terminals inside the port complex. The Autoridade Portuária de Santos is the state company that administers the public port itself. They are different businesses with different networks, different systems and different responsibilities.

The threat-intelligence record names Santos Brasil, not the authority. SOCRadar identified two employee credentials tied to the santosbrasil.com.br domain in stealer-log repositories, and one tracker's record of the leak-site entry describes the claimed material as terminal operating system database scripts and operational records. No authority has established any link between that October listing and last week's outage, and the Federal Police said the claim on its own was not enough to prove an intrusion. A tenant's extortion claim is not the landlord's breach — but it is the reason investigators are looking here first.

Encrypted Data, or No Encryption at All

Four accounts of the mechanism do not fit inside each other. TV Globo reported that the authority realised it was dealing with an attack when it tried to restore its systems and found encrypted data. Ransomnews describes n0n as an operation that has not been observed encrypting systems at all. CNN Brasil reported that the malicious program was already present on the authority's network before Friday's power failure, and was activated after the electricity went out.

A Tribuna, the Santos newspaper, reported that suspected hackers demanded payment to release the systems — a claim the authorities have not confirmed. DatamarNews reported that the Federal Police were examining whether a cyberattack occurred at all, or whether third parties simply exploited the instability to demand money. A pure-extortion crew does not encrypt; a power failure does not normally produce ransom demands. Somewhere in those four sentences is what actually happened, and nobody has published it yet.

The Police Have Not Confirmed a Crime

The Federal Police's Santos unit opened an inquiry early on Tuesday afternoon, and in the same breath said it could not attribute the failures to a cyberattack before the technical analysis is finished. That is not evasion; it is the difference between a suspicion and a case. The suspicion was strong enough for the São Paulo state public security commission for ports, Cesportos-SP, to raise the port's protection level to two on a three-point scale on Sunday, 8 November.

The order was signed by the Federal Police delegate Edson Patrício do Nascimento, who coordinates the commission, and it cited instability in the public gate systems that register the movement of people and vehicles. Level two means more inspections and tighter access control; level three is the maximum. Brazil's ports normally sit at level one. The data protection authority, ANPD, was notified on Monday and has begun reviewing the documentation the port submitted, and may demand more.

What Actually Kept Moving

The authority insists no service was suspended, and there is real evidence behind that claim. Vessel arrivals and departures continued. Land access continued. The federal Porto Sem Papel system, which carries document exchanges between public agencies and port companies, was not affected and absorbed some of the paperwork. DP World, which runs a private terminal on the left bank, reported only slowness in the integration between its systems and the authority's portal, and said operations were unaffected.

What broke was the administration. Route scheduling, arrival records and invoicing were done by hand, according to Folha de S.Paulo. Checks on whether a vessel's dimensions fit an available berth were done manually too. A Tribuna reported that around eighty per cent of the authority's administrative staff were working remotely because of the conditions at headquarters. Nothing stopped; everything slowed, and the port spent five days unable to publish a notice on its own website.

A Record Year and One Point of Failure

That matters because of what this port is. Santos moved 186.4 million tonnes of cargo in 2025, a record and a 3.6 per cent increase on the previous year, including 5.9 million twenty-foot equivalent units of container throughput. It handled 29.6 per cent of the value of Brazil's entire foreign trade, up from 29.0 per cent a year earlier. Around 5,700 vessels called there last year, and roughly 7,500 trucks pass through it every day.

It connects more than 600 destinations and handles cargo from more than 200 countries across fifty-three terminals, seventy kilometres from São Paulo. Lloyd's List ranks it thirty-seventh in the world for container handling. And the authority runs its own data processing and storage infrastructure rather than outsourcing it. That is efficient until the day the servers stop, and then the administrator of the busiest port in Latin America is doing berth checks with a clipboard.

The Month Brazil Started Counting

None of this is happening in a quiet year. The ANPD received 672 notifications of cybersecurity incidents in 2026, according to O Globo, against 395 in 2025. G1 put the figure at 677 and the increase at seventy per cent. CBN reported more than 670 and an increase of sixty per cent. The three numbers measure overlapping things and none of them makes the trend look smaller.

Brazilian coverage has taken to calling October the dark month. Air-raid alert apps were hacked in both Ukraine and Russia. Denmark's population register was breached, as were systems at the United States Department of Homeland Security and the FBI, and Japan declared a cybersecurity state of emergency. Brazil's own Mercado Bitcoin was hit on 2 November, with specialists estimating around forty-nine million dollars in assets compromised. General Marcos Lehmkuhl de Souza, who heads the Army's cyber defence centre, said there was no reason for panic: "We have not observed extremely coordinated attacks against Brazil at the moment."

The Drill on the Same Coast

On Monday, three days after the outage began, the Brazilian Navy began Operation Trident III between Santos and Praia Grande, simulating threats to undersea fibre-optic cables and other strategic infrastructure. The exercise runs to Thursday. For the first time it includes the Navy's cyber warfare squadron and Brasil Terminal Portuário, one of the private terminals inside Santos, and it was publicly announced on 8 November.

No one has suggested a connection between the drill and the outage, and there is no evidence of one. It was scheduled, and it is the third in the series. But the context is worth holding: Anatel, the telecoms regulator, says about ninety-nine per cent of Brazil's international data traffic crosses submarine cables, and the Baixada Santista was chosen for this exercise precisely because that is where they land. Two events about the same coastal infrastructure in the same week, one planned and one not.

What Would Actually Change

Here is what to watch, and it is not a press release. The first question is whether data left the network, because the authority says it cannot tell and the ANPD will eventually have to. The second is whether the October claim and the November outage are the same operation, because the answer decides whether this was an intrusion or an opportunist reading a newspaper. The third is the forensic report on those backups.

And the fourth is the one that should worry every operator of a port, a grid or a hospital: a power failure took down the administrator of a port handling nearly thirty per cent of a continental economy's trade, and five days later it still could not say what had been touched. Folks, that is not a Santos problem. That is a template. When your critical infrastructure depends on one room full of servers, the question is never whether something will go wrong — it is whether anyone will be able to tell you what did.

By Jessica Ali, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: G1, TV Globo, CBN, CNN Brasil, Folha de S.Paulo, O Globo, Agência Brasil, A Tribuna, DatamarNews, Carta Capital, Olhar Digital, SOCRadar and Ransomnews. Cover: Global 1 News editorial image.