North Carolina Ports Cyberattack Forces Manual Cargo Processing at Wilmington

North Carolina Ports, the state authority that operates the Port of Wilmington, the Port of Morehead City and the Charlotte Inland Port, is still working through the aftermath of a cyberattack that took down its information technology systems in early August 2026. The authority detected the intrusion late on Tuesday, August 4, and its IT team activated the agency Cybersecurity Contingency Plan the same night. The breach forced all three facilities to fall back on manual cargo processing, which slowed truck turn times and delayed gate openings across the system.

The first public sign of trouble was an operations alert posted on the authority website on August 4, warning of a systems-wide outage. Gates at all three sites opened at 08:00 Eastern Time on Wednesday, August 5, later than usual, and customers were told to expect delays. In Wilmington, the operations team combined the delayed opening with manual gate processing so that IT staff could concentrate on restoring systems. Terminal operations and vessel calls went ahead as scheduled throughout the disruption.

By the morning of August 5 the authority said the breach had been contained and that recovery work had begun. It brought in an outside forensics team to work alongside its own IT department, and it notified the North Carolina Department of Transportation, the North Carolina Department of Information Technology and the United States Coast Guard. The Coast Guard confirmed that it was monitoring the situation and coordinating with state authorities and federal partners, and it reported no effect on maritime safety.

Normal gate schedules returned on Thursday, August 6, although cargo was still being handled manually at that stage. On Friday, August 7, the authority posted that all three gates would run on a normal operating schedule while IT teams continued to assess affected systems and restore services. As of Monday, August 10, the recovery was still under way and the authority had not published a timetable for full restoration of its digital systems, nor an estimate of how much truck or cargo traffic had been delayed.

A week after detection, several key details remain undisclosed. The authority has not said how the attackers gained access, which systems were compromised, or whether ransomware was involved, and no group has claimed responsibility. Officials stated that there is currently no indication that sensitive data was taken, and no ransom demand has been reported. It also remains unclear whether cargo tracking, rail moves or vessel scheduling data were touched beyond the gate systems.

The three facilities move more than 4 million tons of general cargo and handle roughly 1,000 ship calls each year. Wilmington is the main container gateway of the state, with nine berths, seven ship-to-shore cranes and an annual container capacity of 600,000 TEU for a throughput above 320,000 TEU, and it averages about 5,000 container gate moves per week. Wilmington and Morehead City together moved 4.4 million short tons of bulk and breakbulk cargo over the past year. Morehead City is one of the deepest bulk and breakbulk facilities on the United States East Coast, while the Charlotte Inland Port links the coast to manufacturers and distribution centers along the I-85 and I-77 corridors through intermodal rail service.

The cargo passing through these terminals supports agriculture, forestry, construction and infrastructure work across North Carolina, and the Port of Wilmington sits within 700 miles of more than 70 percent of the United States industrial base. Refrigerated agricultural exports are particularly sensitive to gate delays because chilled and frozen loads have narrow booking windows. Even a short interruption at a gate that handles thousands of container moves a week can build truck queues, push containers past their cut-off times and generate demurrage and detention charges for shippers.

Maritime operators have been under growing pressure from cyber threats. In June 2026 the Qilin ransomware gang said it had breached the Shipping Association of New York and New Jersey, an organization representing terminal operators, ocean carriers and stevedores at one of the busiest port complexes in North America, and claimed to have published stolen data. Coast Guard cybersecurity rules that took effect in July 2025 require covered ports, facilities and vessels to maintain cybersecurity plans, name accountable officers and set out procedures for detecting, responding to and recovering from attacks. Security specialists point out that attackers do not need to steal data to cause economic damage, because slowing the availability of essential services is enough to ripple through logistics networks.