DP World Australia shut its ports for days after an unpatched-vulnerability hack

On November 10, 2023, DP World Australia — responsible for 40% of the country's maritime freight — shut down operations at its ports in Melbourne, Sydney, Brisbane and Fremantle in response to a cyber attack, stalling goods moving in and out of the country. Operations resumed on the morning of November 13, and the company cleared the resulting backlog of 30,137 shipping containers a week later, on November 20.

Executive vice president Nicolaj Noes later confirmed the personal data of some current and former employees was stolen — for some colleagues phone numbers, for others addresses, and for 'a very few amount of people' items including a copy of a driver's licence — while customer data was not compromised. No ransom demand had been received, and the attack remained under investigation by the Department of Home Affairs, the Australian Cyber Security Centre and the Australian Federal Police.

The uncomfortable detail: multiple cybersecurity analysts had told the ABC that the company failed to fix a critical vulnerability known as CitrixBleed — the most likely route into its systems — despite an update being available for more than a month. Asked whether DP World Australia was vulnerable because it had failed to properly update its systems, Noes did not answer directly, but conceded he would have 'done some things differently' in hindsight.

A three-day shutdown across four ports handling 40% of Australia's maritime freight; a 30,137-container backlog; staff data stolen.

Analysts told the ABC the company had not fixed the CitrixBleed vulnerability for more than a month before the attack, despite an available patch.

The company disconnected all four terminals rather than risk a compromised network running the country's freight.

Asked directly about missed updates, Noes declined to answer but said he would 'probably' have done some things differently.

A known vulnerability with a shipped patch is a decision, not an accident: delay the fix and the outage clock is already running.

Freight flows resumed and the backlog was cleared by November 20, but Noes warned of further delays into Christmas as workers at all four terminals took protected industrial action over pay and rosters — including a planned 48-hour stoppage and two-hour stoppages three times a day at some sites.