Loading story…
A ransomware attack hit Spain’s Port of Vigo, disrupting cargo traffic management systems and other digital services while forcing authorities to disconnect affected parts of the network. Port officials said some equipment was locked and the attackers sought a ransom payment, prompting cybersecurity teams to keep systems offline until they can verify the environment is secure. Investigators are still working to determine the initial access vector and whether any sensitive data was compromised.
Physical port activity, including ship movements and cargo handling, continued, but logistics coordination through digital platforms was impaired and some cargo-related processes were shifted to manual operations. Port president Carlos Botana said there is no timeline for full restoration, underscoring the operational risk ransomware poses to ports and other maritime organizations that support critical trade flows.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Port president Carlos Botana said affected systems would remain offline until security teams were confident the network was safe. Authorities also began investigating the initial access vector and whether any sensitive data had been compromised.
After detecting the attack early Tuesday, authorities disconnected affected parts of the network to contain the incident. Some cargo-related and logistics coordination processes were moved to manual operations, while physical port activity continued.
A ransomware attack disrupted digital systems at Spain's Port of Vigo, affecting servers used for cargo traffic management and other digital services. Officials said some equipment was locked and that the attackers sought payment of a ransom.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Anubis** ransomware group breached the Adriatic Port Authority, which operates the Italian port of Ancona, in an intrusion that reportedly began with a spear-phishing attack on **December 11, 2025** and was publicly attributed after the victim appeared on the gang’s leak site in January 2026. Reporting indicates the attackers moved through the authority’s IT environment rather than operational technology systems and exfiltrated a limited set of data, including employee records and sensitive port security-related documents. Security researchers said the compromise may have been enabled by weak cloud account protections in **Office 365** and **Azure**, alongside broader exposure to unpatched internet-facing systems commonly exploited by ransomware-as-a-service operators. The incident has been highlighted as a warning for the maritime sector, where aging IT infrastructure and comparatively low cyber maturity continue to leave port authorities vulnerable to disruptive and data-theft-focused attacks.
Aug 11, 2026
North Carolina Ports said a cyberattack by an outside actor disrupted IT systems and gate operations across the Port of Wilmington, the Port of Morehead City, and the Charlotte Inland Port, forcing the authority to activate its cybersecurity contingency plan and process operations manually. The incident was detected on August 4, with recovery efforts beginning the next morning, and officials said the outage slowed truck traffic and broader port activity while gates remained open under manual procedures. The North Carolina State Ports Authority said the breach has been contained and that an external forensics team is assisting the investigation and restoration effort. The U.S. Coast Guard and multiple state agencies are monitoring and coordinating the response, while the ports authority has not disclosed the attack's nature, whether data was stolen, or whether ransomware was involved. By Friday, normal gate and vessel schedules had resumed, but delays were still expected as IT teams continued system recovery.
Aug 10, 2026
A ransomware attack on Colonial Pipeline’s IT environment forced the company to temporarily halt pipeline operations, causing fuel supply disruptions across parts of the United States. Dragos said with high confidence that the **DarkSide** ransomware group was responsible for the compromise and described the incident as the most disruptive cyber intrusion it had seen affecting U.S. energy infrastructure. The shutdown highlighted how closely linked IT and OT environments can be in industrial organizations, allowing an enterprise-system intrusion to trigger major operational consequences. As Colonial Pipeline restarted service, U.S. officials warned that fuel availability would recover gradually and urged the public not to panic-buy gasoline or accept price gouging. The FBI said the Russian government was not behind the attack, though the perpetrators were believed to be operating from Russia. Reporting on the incident also pointed to common ransomware entry paths, including weak passwords on internet-exposed services and exploitation of devices such as **Pulse Connect Secure**, **Fortinet FortiOS**, and **Accellion FTA**, while recommended defenses included stronger network segmentation, improved monitoring and logging, offline backups, and exercised OT incident response plans.
Aug 15, 2026