Bahasa Melayu← Malaysia Cyber Watch
Port of Tanjung Pelepas halted by a cyber incident
Port of Tanjung Pelepas (PTP) in Johor paused terminal operations for several hours after a cyber incident shortly before midnight on 9 September 2026. The Direwolf ransomware group later listed the port on its leak site, a claim PTP has not confirmed.
Key facts
- OrganisationPort of Tanjung Pelepas (PTP) in Johor, run by AP Moller Maersk in a joint venture with MMC. It handled more than 14 million TEU in 2025.
- What happenedPTP confirmed a cybersecurity incident that affected operating systems and temporarily halted container terminal operations. A phased restart began on 10 September.
- Systems affectedTerminal operating systems. Maersk warned that some vessels may face delays.
- Not affectedPTP told shippers it had found no evidence of unauthorised access to customer data.
- Cause or entry pointPTP has not said how the attackers got in.
- ClaimedThe Direwolf ransomware group listed PTP on its leak site on 11 September and claims to hold 200 GB of data. PTP has not confirmed the claim.
Timeline
- 9 Sep 2026Attackers hit PTP shortly before midnight, and terminal operations pause. The Loadstar
- 10 Sep 2026PTP restores the affected system and begins a controlled, phased restart of terminal operations. Lloyd's List
- 11 Sep 2026Maersk confirms a cybersecurity incident and says operations are progressively resuming, with some vessel delays possible. The Loadstar
- 11 Sep 2026Direwolf lists the port on its leak site and claims 200 GB of data. ransomware.live
Incident record
| Organisation | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|
| ✅ ConfirmedPort of Tanjung PelepasJohor | 10 Sep 2026 | Transport | Ransomware | DireWolf | Confirmed. A cyber incident halted terminal operations overnight; systems were isolated and restored. Claimed. Direwolf listed the port on its leak site and claims ransomware and data theft. | The Loadstar · ransomware.live✓ 7 Nov |
What to do
- Shippers and forwarders should check vessel and container status with their carrier or PTP's official customer channels before rebooking.
- Treat any email about the incident that asks you to change bank details or open attachments as suspect, and confirm it by phone with a known contact.
- Report suspicious emails or files linked to the incident to CyberSecurity Malaysia's Cyber999 service.
- If you lose money to a payment scam, call the NSRC hotline on 997 straight away.
FAQ
What happened at Port of Tanjung Pelepas?
A cyber incident shortly before midnight on 9 September 2026 halted container terminal operations for several hours. PTP began a phased restart on 10 September.
Was data stolen from PTP?
PTP said it found no evidence of unauthorised access to customer data. The Direwolf group claims to hold 200 GB of PTP data, and that claim is unverified.
Who is behind the PTP cyberattack?
PTP has not named an attacker. The Direwolf ransomware group listed the port on its leak site on 11 September 2026.
Related stories
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- Amadeus airline data breach South Korea, Japan, Hong Kong +3 · 4 Nov 2026
- Rakuten Trade halts Bursa trading after a cyber attempt Malaysia · 30 Oct 2026
- Tabung Haji suspends all services after a cyberattack Malaysia · 8 Oct 2026
Checked 7 Nov 2026. Methodology · Data CC BY 4.0