A Data Breach at Logistics Giant PortLynk Is Rippling Across Banks, Retailers, and Beyond

PortLynk disclosed on Friday that an intruder maintained access to its shipment management platform from mid-May until early August, a dwell time of at least eleven weeks. The company handles customs documentation and container tracking for more than 3,000 corporate customers across eleven African ports.

The exposure is broad because the data is. Customs filings contain shipper and consignee identities, declared values, letters of credit references, and in many cases the bank facilitating the trade. Three banks have told corporate clients to treat trade-finance instruments referenced in PortLynk filings as potentially compromised, and two retailers have begun re-issuing supplier payment instructions after fraudulent redirection attempts.

"This is the shape of the modern breach on this continent," said incident responder Musa Dlamini of the Johannesburg firm Nkanyezi Security, who is not working the PortLynk case. "Nobody attacks the bank anymore. They attack the company that emails the bank a spreadsheet every Tuesday."

PortLynk says it has rotated credentials, engaged an external forensics firm, and notified regulators in four jurisdictions. What it has not yet said is how the intruder got in — a detail that matters enormously to the several dozen logistics platforms running comparable architectures and wondering whether they are next.