Cyberattack threatens to spark Christmas goods shortage

“An ongoing delay is going to have a significant impact on all import and export containerised trade,” he said.

Shipping containers are typically used to carry household goods, furniture, electronics and toys that are then trucked to distribution centres and onto retailers.

“This incident does not discriminate. All imported containerised cargo will be impacted, which could potentially range from medical supplies through to toys for Christmas. The full impacts will be known in coming days in terms of the nature of goods stuck in the thousands of containers sitting idle at DP World’s terminals nationally,” Zalai said.

However, online shoppers are likely to escape the worst of any disruption — most e-commerce retailers use air freight for delivery.

Grocery giant Woolworths said it was keeping a close eye on the issue, with most of its festive-season stock onshore.

Loading

“We’re monitoring the situation. However, we don’t anticipate any immediate impacts at this time,” a spokeswoman said.

Endeavour Group, which operates liquor giant Dan Murphy’s, declined to comment. Wesfarmers, which operates Target, Kmart and Bunnings, was approached for comment.

The Australian Federal Police has confirmed it is investigating the incident, which cyber experts believe to be a ransomware attack.

“As the matter is ongoing, it would not be appropriate to comment,” the AFP said.

Late on Saturday, National Cyber Security Co-ordinator Darren Goldie indicated there would not be a quick fix for the incident.

“This interruption is likely to continue for a number of days and will impact the movement of goods into and out of the country. DP World Australia is working with its stakeholders to consider the impacts on its operations at specific ports,” he said.

On Sunday, Home Affairs and Cybersecurity Minister Clare O’Neil described the hack as serious and ongoing.

“This incident is a reminder of the serious risk that cyberattacks pose to our country, and to vital infrastructure we all rely on,” she said.

Cybersecurity researcher Troy Hunt, the founder of data breach tracker Have I Been Pwned, said disruptions to Australian consumers could last weeks and affect Christmas deliveries.

“If you think back to COVID, look at the sheer number of things that got disrupted just because bits and pieces couldn’t get delivered,” Hunt told this masthead. “It depends on what’s actually been done here as well; have [DP World’s] internal systems been trashed?”

He pointed to preliminary research from cybersecurity veteran Kevin Beaumont that found DP World had probably fallen victim to a ransomware attack made possible by a vulnerability in Citrix NetScaler software.

Hunt said ransomware groups were now far more professional than they used to be, running websites listing every victim along with a countdown timer showing how much longer they had to pay up.

“There’s … a financial motive for this sort of stuff,” he said. “Of course, we’ve seen this in Australia recently with the Medibank situation, we’re seeing this more and more.

“If you have a spin through some of the dark web ransomware websites, it’s just stunning the number of organisations that are listed on there.”

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.