Cyberattack on North Carolina Ports ‘contained’ as Coast Guard, state officials investigate
North Carolina Ports is in the process of restoring its systems after a cybersecurity incident forced a shift to manual operations on Tuesday.
A spokesperson for the ports, which handle more than 4 million tons of cargo each year, said the IT system was “hacked by an outside actor or group” requiring them to enact a contingency plan and contact multiple state agencies as well as the U.S. Coast Guard.
“The breach has been contained, and we are now in the recovery process,” the spokesperson told Recorded Future News, adding that the incident affected all three North Carolina Ports locations of Wilmington, Morehead City and Charlotte.
The facilities are “following a normal operating schedule today,” he said, “however, operations are still being processed manually.”
An outside forensics team is working with the IT department to assess and restore affected systems. The spokesperson did not respond to questions about whether it is dealing with a ransomware attack.
A notice on the North Carolina Ports website says the gates at all three ports will operate normally on Thursday but delays should be expected.
Local news outlets reported that since Tuesday, there were signs outside of port gates warning companies of delays “due to system issues."
No hacking group has come forward to take credit for the attack. Ports in the U.S., Europe and Asia have been repeatedly targeted by ransomware gangs over the last five years as many shift to incorporate digital operations. In 2024, the Port of Seattle refused to pay a ransom to cybercriminals that caused issues at the city’s airport and seaport ahead of the Labor Day holiday.
On Wednesday, Senator Tom Cotton (R-Ark.) sent a letter to Treasury Secretary Scott Bessent asking him to encourage investment in and modernization of American operational technology.
“This technology is underfunded and outdated, leaving vital infrastructure like water systems, power facilities, and industrial plants, particularly in rural states like Arkansas, vulnerable to cyberattacks by our adversaries,” Cotton wrote.
“Attacks on civilian infrastructure have become a routine instrument of modern warfare, and American operational technology is a target.”
References in this story
- Ransomware attack disrupts operation at major Spanish fishing port therecord.media A ransomware attack has disrupted digital systems at Spain’s Port of Vigo, forcing authorities to disconnect parts of its network and temporarily manage cargo operations manually.
- Major Japanese port suspends operation following ransomware attack therecord.media A cybercrime group believed to be operating out of Russia hit the largest and busiest trading port in Japan with a ransomware attack.
- Seattle's airport, seaport isolate systems after cyberattack therecord.media The Port of Seattle, which oversees the Seattle-Tacoma airport, said there was no timetable for when certain systems would return to normal after an incident disrupted services over the weekend.
- Advanced Cyber Threat Intelligence | Recorded Future www.recordedfuture.com Get real-time, actionable cyber threat intelligence with Recorded Future. Mitigate cyber risks, prioritize threats, and proactively secure your organization.
- jon greig (@jgreigj) on X twitter.com @TheRecord_Media cybersecurity reporter. formerly @zdnet @cambodiadaily @haitiantimes_ — send tips to [email protected] or signal: jgreig.51
- jon greig (@jgreig.bsky.social) bsky.app cybersecurity reporter for The Record. formerly: zdnet, techrepublic, blavity, haitian times, cambodia daily — send tips to [email protected] or signal: jgreig.51
