The significance of the disruption is underscored by PTP’s central role in global trade. The wider Johor port complex, which includes PTP and the Pasir Gudang container terminal, handled a record 15.1 million TEU (twenty-foot equivalent units) in 2025. Of this volume, more than 14 million TEU moved through PTP alone, highlighting its status as a major transhipment hub and a key component of the Gemini Cooperation network between Maersk and Hapag-Lloyd. The incident serves as a stark reminder of the maritime sector’s growing exposure to cyber threats, with industry experts noting that ports are often targeted because they concentrate trade, data, and critical infrastructure.
In response to the incident, PTP introduced manual gate-in processing for laden and empty export containers, including free zone inter-terminal transfers, starting at 19:30 local time on September 10. A spokesperson for Maersk, which operates PTP in a joint venture with Malaysian conglomerate MMC, confirmed that the affected systems have been restored and that the company is actively managing the operational impact. “While some vessels may experience delays, our priority is to minimise disruption to customers and support the continued normalisation of operations and supply chains,” the spokesperson told Lloyd’s List. Vessel tracking data from Lloyd’s List Intelligence suggested that the operational impact was limited, with most scheduled arrivals and departures continuing without significant delays. However, the 15,226 TEU Maersk Hanoi, sailing from Pointe Noire, deviated from its route for approximately 10 hours while transiting the Strait of Malacca before resuming its voyage to the Malaysian hub. PTP stated there is no evidence of unauthorized access to customer data, though it is working with cybersecurity experts to investigate the incident and implement additional security measures.
The incident at PTP has prompted a broader national response. The National Security Council (MKN), under the Prime Minister’s Department, has raised the cybersecurity threat level from ‘low’ to ‘medium.’ This precautionary measure, reported by Bernama, is aimed at ensuring the nation’s essential services remain operational in light of current security developments. The MKN stated that the National Cyber Security Agency (Nacsa) has held meetings with sector heads and entities within the National Critical Information Infrastructure (NCII) to strengthen preparedness coordination.
All NCII entities have been mandated to implement nine cybersecurity preparedness measures, including 24-hour monitoring, system patching, multi-factor authentication, and the updating of service continuity plans. Sector heads are also required to submit weekly threat status reports to Nacsa. These measures were presented during a special meeting of ministry secretaries-general and heads of service. Nacsa, through the National Cyber Coordination and Control Centre (NC4), is executing three key operational functions: issuing cybersecurity alerts and advisories, strengthening threat detection and assessment capabilities, and conducting cybersecurity monitoring of NCII entities and government agencies. In October alone, NC4 issued eight alerts and advisories regarding vulnerabilities affecting NCII entities and government agencies.
Prime Minister Anwar Ibrahim addressed the issue in the Dewan Rakyat on November 3, stating that Malaysia is among the countries potentially targeted for cyberattacks due to the strength of its digital infrastructure and data centres. He noted that the government’s firm stance on international issues, particularly concerning Palestine and Gaza, contributes to this risk assessment. Ibrahim emphasized that this assessment is based on intelligence gathered by the government, although not all details regarding these threats can be disclosed to the public.
The vulnerability of Malaysia’s digital infrastructure extends beyond port operations. Recent guidelines suggest that a major tech blackout could disrupt essential services, including payments, water supply, and telecommunications. Modern Malaysian commerce is heavily reliant on QR payments and e-wallets, meaning a cyber incident targeting payment gateways or telecommunications could paralyze cashless transactions. Authorities have advised citizens to prepare for potential grid failures or cyber disruptions by keeping physical cash reserves, ensuring access to physical identification documents, and understanding the interdependencies between power, telecommunications, and digital services. The incident at PTP underscores the critical need for robust cybersecurity measures across all sectors of the national critical information infrastructure to maintain stability and sovereignty in an increasingly connected world.
