A ransomware attack has disrupted digital systems at Spain’s Port of Vigo, forcing authorities to disconnect parts of its network and temporarily manage cargo operations manually, port officials said Wednesday.

The attack was detected early Tuesday and affected computer servers used to manage cargo traffic and other digital services at the port, located in the Galicia region on Spain’s northwest coast. Officials told local media the incident locked some equipment and involved a ransom demand.

In response, the port authority’s technology team isolated the affected systems from external networks to limit the impact.

Port president Carlos Botana said the port will not reconnect its systems until security teams are certain the network is safe.

“We will not restore connections until there are absolute guarantees that there is no possibility of another attack,” Botana told local media, adding that there is currently no estimated timeline for restoring normal digital operations.

The port’s physical operations — including ship movements and cargo handling — continue to function, but logistics coordination normally managed through the port’s digital platforms has been disrupted. Some operators have been instructed to rely on manual procedures and paper documentation to continue working.

An investigation is underway to determine how attackers gained access to the network and whether any sensitive data was compromised. Botana described the incident as a financially motivated cyberattack aimed at extracting ransom payments. No cybercrime group has claimed responsibility for the attack so far.

Ports and maritime organizations have increasingly become targets for ransomware gangs in recent years because of their critical role in global trade.

In 2023, Japan’s Port of Nagoya temporarily suspended operations following a ransomware attack attributed to the LockBit cybercrime group. Ports across Belgium, the Netherlands, Germany, Portugal, Japan, Australia and in U.S. cities like Houston have all faced attack. Several shipping technology giants have also dealt with cybersecurity incidents that snarled operations for days.