A Power Cut Found the Virus Already Inside Brazil's Largest Port. The Port Still Cannot Say What It Reached.

By LCN Business Desk

More than a quarter of Brazil's foreign trade clears the Port of Santos. Its authority confirmed on Tuesday 10 November 2026 that the port's systems had been the target of a cyberattack, four days after they began failing.

Did the power cut cause the breach, and what is still running?

No, it exposed it, and cargo never stopped. The authority found the virus was already on its network before the power failed.

Sources: Autoridade Portuária de Santos statements as reported by CNN Brasil and Jornal do Comércio, 10 and 11 November 2026.

Neither the authority nor the reporting says when the virus arrived. The interval between its arrival and the power cut that found it is the number a port, a utility or a bank would most want from this incident, and the detection event was an electrical fault rather than a security control.

Ship movements and land access continued throughout. The authority says operations run normally, that there is no risk of the complex halting, and that its contingency plan substitutes alternative procedures for activities depending on digital systems, which it says may slow administrative work but not operations. Navigators, importers and terminals told CNN Brasil they saw no operational impact, and DP World reported slowness in its portal integration and nothing further.

What changed is the gate. Cesportos-SP, the São Paulo state commission for port security, put public access at protection level II from Sunday 8 November, with reinforced control over the entry and exit of people and vehicles. The regime binds every haulier and agent calling at the terminal while it holds.

Recovery is being run by the authority's technology staff, outsourced firms and Serpro, the federal data processing service, working from backups. No completion date has been given.

The Polícia Federal opened an inquiry into the attack, announced late on Tuesday 10 November and attributed to the force by CNN Brasil and other Brazilian outlets, with no date given for its conclusion.

What does the port say about the data?

That it does not know. The authority says it has not been able to determine the extent of the incident or whether data was accessed.

Brazil's notification rules make that statement load-bearing rather than merely cautious. Under Resolução CD/ANPD nº 15 of 24 April 2024, a controller has three working days to notify the national data protection authority of a security incident. It has a further three working days to notify the people whose data was affected, and that clock runs from the moment the controller knows personal data was affected.

Source: Resolução CD/ANPD nº 15 de 24 de abril de 2024. Deadlines double for small-scale processing agents.

The authority has been reported as having informed the ANPD. The second clock has not started on its own account, because it says it does not yet know what was reached. The regulation also allows the ANPD to open its own procedure into an incident a controller has not reported.

What does this mean for anyone shipping through Santos?

Slower paperwork and tighter gates, on no announced end date.

Sources: Santos Port Authority data as reported by DatamarNews and DataPortuaria. Figures are trade-press reports of authority data.

Santos is the route through which a large share of the region's Brazilian cargo moves, and it was setting records in the months before this. Brazil shipped a record 14.49 million tonnes of crude and a record 287,300 tonnes of green coffee in October 2026, with oil revenue up 122.6 per cent on prices that climbed 36.7 per cent while coffee revenue rose 5.2 per cent on prices that fell almost 15. The volumes that produced those records pass over quays now running manual checks.

Why does this matter beyond Brazil?

Because the regional assessments already named this category of asset as the weak one, and because the disclosure question has a recent regional precedent.

The 2025 IDB and OAS cybersecurity report benchmarked thirty Latin American and Caribbean countries and found that critical infrastructure protection, software quality and cybersecurity market development remain at lower maturity levels, while CARICOM launched an updated Cyber Security and Cybercrime Action Plan in Port of Spain on 31 October 2025. A port authority is that category of asset.

On disclosure, the regional comparison is recent and unresolved. Aeroméxico told the Mexican public on 20 and 21 September 2026 that customer data taken in October 2025 was being offered on Telegram, and twenty days on had furnished no Form 6-K to the United States Securities and Exchange Commission. Where a breached company reports, and to which regulator, is becoming the measurable part of these incidents.

And the smaller operators are being warned about the same tooling. The National Computer Incident Response Team of The Bahamas issued an Akira ransomware alert on 22 October 2026 naming no confirmed attack at home, with the FBI and three other agencies putting the group's proceeds at US$244.17 million.

Key figures

- 27.7 to 28 per cent. Santos's share of Brazil's foreign trade, worth US$140.8 billion on the lower figure. - 4.52 million TEU. Containers handled January to September 2026, up 3.5 per cent and a record for the period. - Four days. The interval between systems failing on 6 November and the authority naming a cyberattack as the cause on 10 November. - Three working days. The deadline to notify Brazil's data protection authority of a security incident under Resolução CD/ANPD nº 15 of 2024, and separately to notify affected individuals once the controller knows personal data was affected. - No date. The completion date given for recovery. - Unestablished. When the virus arrived on the network. It was there before the power cut that found it. - Protection level II. The setting for public access at the port since 8 November 2026, imposed by Cesportos-SP, meaning reinforced control over the entry and exit of people and vehicles. - Unknown. Whether data was accessed, on the authority's own account. - 518,600 TEU. Containers handled in September 2026, a record for that month, against 538,200 in August, the best month on record.

Frequently Asked Questions

What happened at the Port of Santos?

Systems began failing on 6 November after a power cut on the servers, and on 10 November 2026 the Santos Port Authority confirmed the cause was a cyberattack. CNN Brasil reported the authority's finding that the virus pre-dated the power cut.

Have port operations stopped?

No. Ships moved, land access held, and the authority says there is no risk of the complex halting. The disruption fell on administrative and digital services, where a contingency plan put alternative procedures in place. The terminal operator DP World reported only that its portal integration had slowed.

Was data taken?

It says so itself: the extent of the incident is undetermined, and so is whether anything was read. No leak has been confirmed.

What is protection level II?

A raised security posture for the port's public access, brought into force by Cesportos-SP, the state port security commission, on 8 November 2026. It means reinforced control over the entry and exit of people and vehicles.

What does Brazilian law require after an incident like this?

Under Resolução CD/ANPD nº 15 of 24 April 2024, a controller must notify the national data protection authority within three working days, and must notify affected individuals within three working days of knowing that personal data was affected. Information may be supplemented within twenty working days of the first communication. Deadlines double for small-scale processing agents, and the authority may open its own procedure into an incident that was not reported.

The entities

• Autoridade Portuária de Santos (APS), the Santos Port Authority, is the state company that administers the Port of Santos.
• Port of Santos, the Porto de Santos, is Brazil's largest port and is described by Datamar as Latin America's largest.
• Cesportos-SP is the state commission for public security in ports, terminals and waterways in São Paulo, which sets the port's protection level.
• Serpro, the Serviço Federal de Processamento de Dados, is Brazil's federal data processing service, assisting the recovery.
• ANPD, the Autoridade Nacional de Proteção de Dados, is Brazil's national data protection authority.
• Resolução CD/ANPD nº 15 of 24 April 2024 is the regulation governing communication of security incidents under Brazil's data protection law.
• DP World is the terminal operator that reported slowness in its portal integration.