Transnet 'Death Kitty' ransomware (South Africa, 2021)

On 22 July 2021, Transnet — the state-owned operator of South Africa's freight rail and major sea ports — was hit by a ransomware attack severe enough to force the company to declare force majeure at the country's container terminals. Durban, Ngqura, Port Elizabeth, and Cape Town all stopped operating normally.

What happened

The ransomware family was identified by researchers as part of the "Death Kitty" / "HelloKitty" / "Five Hands" cluster — overlapping criminal operations with likely Russian or Eastern European origin. Transnet's container-terminal operating systems were disabled along with much of its corporate IT.

The operational fallback was striking: port workers reverted to manual ship-movement tracking and paper-based cargo clearance. At Durban, which handles roughly 60% of Southern Africa's containerised trade, processing times for imports increased substantially. Transnet declared force majeure at Durban, Ngqura, Port Elizabeth, and Cape Town container terminals — releasing the operator from contractual obligations because of the extraordinary disruption.

Recovery took approximately a week of intense restoration work. Two weeks later, the Minister of Public Enterprises stated that 90% of IT systems had been fully recovered and secured.

Impact

• Container operations at Durban, Ngqura, Port Elizabeth, and Cape Town disrupted.
• Force majeure declared at major South African ports.
• Manual paper-based clearance reverted to for ~a week.
• Substantial regional economic disruption: Durban alone handles ~60% of Southern Africa's containerised trade.

Why it matters

Transnet is the reference case for critical-infrastructure ransomware in sub-Saharan Africa. It demonstrates that even a major state-owned operator running modern container terminals can be reduced to paper-and-pen logistics in under 24 hours, and that the cascading effect can deny services not just to one country but to an entire region's trade flow.