Update: CMA CGM resumes online services after cyber attack

A statement from CMA CGM said the group’s e-commerce sites and ’main functionalities’ were all operational, allowing customers to book and track cargo and submit and receive invoices.

"All communications to and from the CMA CGM Group are secure, including emails, transmitted files and electronic data interchanges," the statement said. "All our agencies as well as our back-office are now fully operational."

The initial attack, via ransomware, occurred on 28 September and the line has been working to restore its systems for two weeks. Initial reports on the incident can be found below.

30 September, 2020: Update

CMA CGM has isolated the malware at the root of the attack after closing its IT network to external access and implementing alternative container shipment booking procedures

The container shipping giant said it was in the process of determining the degree to which its data has been compromised.

"We suspect a data breach and are doing everything possible to assess its potential volume and nature.

Our technical teams, alongside independent experts, are continuing the investigation," a statement from CMA CGM said.

The line said it has been forced to implement "alternative solutions" for communications with customers and for bookings on its container ship fleet.

CMA CGM said in a statement it "interrupted as a precautionary measure all external accesses to their network and computer applications in order to prevent the spread of the malware".

“This malware was rapidly isolated and all necessary protection measures implemented,” CMA CGM said.

“All communications to and from CMA CGM Group are secure, including emails, transmitted files and electronic data interfaces (EDI). Maritime and port operations are functioning as per usual.”

The line said it has "fully mobilised" to restore all of its information systems and that its back office systems are gradually being reconnected to the network, improving booking and documentation processing times.

CMA CGM identified the cyber attack and first notified customers it had closed external access to IT systems on 28 September.

The container shipping line said the cyber security breach had impacted ’peripheral servers’ and that the line had cut off access to applications to prevent the spread of the malware.

CMA CGM recognised the potential impact on business continuity and created other communication channels.

“We are providing alternative and temporary processes for your bookings and are committed to processing them as quickly as possible,” CMA CGM said.

In its initial statement, the line said it had worked rapidly to reduce the impact and risk from the cyber attack.

“As soon as the security breach was detected, external access to applications was interrupted to prevent the malware from spreading. The website and associated IT infrastructure is down.”

Alternative procedures

CMA CGM said its IT teams are working to resolve the incident and reopen internal networks for bookings and other applications and that it is also using external consultants to try to remedy the impacts of the attack.

In the meantime, the company said it strongly encourages customers to use INTTRA’s web portal or EDI for booking requests, using their existing account with INTTRA. Or to submit a booking request form to their local agent.

There is no information on how long these temporary measures will be in place.

"An investigation is underway, conducted by our internal experts and by independent experts," the line said.