Sistemas administrativos da Autoridade… · Breach

[Single source] Malware hits Port of Santos administrative systems

Nov 10, 2026 · 1 min read

The Santos Port Authority's administrative systems have faced disruptions since November 6, following a power outage. CNN Brasil reported, citing the authority, that malware was already installed on the network and was activated later.

By HIFY Radar newsroom Updated 11/10/2026 07:37 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

The latest account says the Santos Port Authority acknowledged that malware had been present in its network before a November 6 power outage and was detected early on November 7. The authority says administrative systems were disrupted, while ship and cargo operations continued. Whether this was a criminal intrusion, who was responsible and whether data leaked remain unresolved.

What happened

Alleged

According to a November 10 post by cybersecurity researcher Karina Michelin, administrative systems at Brazil's largest port began suffering interruptions after a power outage on November 6. The post says some administrative work moved to manual procedures and access-control failures prompted reinforced security.

Why it matters

Inferred

The incident concerns nationally strategic infrastructure. Even without a reported halt to cargo traffic, disrupted administration and access controls can create operational and security risks, particularly while the cause and possible exposure of information remain unclear.

What to do

Inferred

Treat claims of a cyberattack, ransom demand and involvement by the group called N0n as unconfirmed. The available evidence supports monitoring statements from the port authority, federal investigators and the data-protection regulator rather than assigning responsibility now.

Confirmed and still uncertain

Alleged

The authority reportedly identified malicious software and acknowledged interruptions to administrative systems. Its origin is unknown, N0n's participation has not been established, and there is no reported determination about whether information was leaked. The post also says the Federal Police had been notified but had not opened an inquiry by November 10.

What people are saying

Contested

The public accounts conflict. Michelin's post says CNN Brasil reported, citing the port authority, that malware was found, while Folha de S.Paulo and Terra described the authority as confirming a cyberattack. Authority president Anderson Pomini, however, reportedly told Metrópoles there was no definitive proof of a criminal intrusion.

Evolution

Alleged

The reported sequence began with a power outage on November 6. Malware was allegedly identified at 3 a.m. on November 7. On November 8, Cesportos-SP reportedly raised port security to level II following access-control failures. By November 10, administrative disruption continued and authorities were still offering differing descriptions of the incident.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The post says the malware was already installed before the outage and was activated later, but provides no forensic indicators, malware family, infection route or technical evidence connecting the outage to its activation. A reported demand for payment suggests possible extortion, but that characterization and the attacker's identity are unverified.

Sources and evidence

Observed

The supplied evidence consists of one November 10 X post by Karina Michelin. It synthesizes purported reporting by CNN Brasil, Folha de S.Paulo, Terra, Metrópoles and A Tribuna, but does not include the underlying articles, official notices or forensic records. Its details should therefore be treated as attributed claims rather than independent confirmation.