Le Havre: a container terminal has been shut down for three days, and no one knows why

On the evening of October 13, something stopped working at the port of Le Havre. Containers meant to pass through the Terminaux de Normandie were left stuck. Two days later, handling was still suspended, for both imports and exports, and the operator's phone line appeared to be down, according to Tendance Ouest.

On October 16, the Balguerie group put it plainly: the terminal “is closed and can no longer receive or process containers.” It described a major IT incident, which it dated to October 14. The cause has not been disclosed.

Outage or cyberattack: no one is ruling yet

The Terminaux de Normandie, located at Port 2000, bring together the companies TNMSC and TPO. According to Cyberattaque.org, management acknowledges a “disruption of its information systems that led to a temporary suspension of handling operations.” The systems needed for external communications and data exchange are also affected.

Haropa Port, the port authority for the Seine corridor, says it was informed of IT disruptions at a company in the port sector, which it did not name, and that it is working to restore normal operations. Some dockworkers are talking about a cyberattack. No official statement has confirmed this so far. No date for resuming operations has been announced.

Franck Soulé, executive director of the Le Havre freight forwarders' association, was told that the goods are safe. He does fear a bottleneck when the terminal reopens, with possible financial consequences.

Pro-Russian hackers claim attacks on other ports

On October 14, the M-CERT, the maritime sector's incident response center run by the association France Cyber Maritime, warned professionals that distributed denial-of-service (DDoS) attacks, which knock a site offline by flooding it with requests, were under way or imminent.

On Telegram, the pro-Russian collective NoName057(16) then claimed attacks on the Grand Port maritime de Marseille (Marseille's port authority), Port Atlantique La Rochelle, the shipowners Marfret and Compagnie Maritime Nantaise, and the operator Genavir, according to Stratégies Logistique and the FrenchBreaches site. No major outage has been publicly confirmed at these targets.

On October 13, the website of the SGDSN, the General Secretariat for Defense and National Security, had already been unreachable for more than four hours, according to franceinfo. A group calling itself Cyber Troll Team claimed the attack. The SGDSN calls it a “small attack,” with no data leak since the site is not connected to its internal systems.

Nothing so far links the Le Havre incident to these claims. A flooding attack makes a site unavailable without breaking into it. On its own, it does not explain a terminal being shut down for several days.

What should you do if you depend on a port?

As in the attack on supermarket refrigeration, a single provider can paralyze an entire logistics chain. A few steps to take:

• shippers and freight forwarders: check with your agents which containers are stuck at Le Havre, and plan alternative routes if delays matter;
• port operators: prepare degraded-mode procedures (paper, offline exchanges) for booking and document-exchange portals;
• exposed websites: make sure your hosting provider or content delivery network filters flooding attacks, and report any incident to the M-CERT or ANSSI (France's national cybersecurity agency).

The question remains open: technical failure or attack? The answer will tell us whether France's biggest container port was targeted, or simply fell victim to a breakdown at the worst possible moment.