Australia's biggest ports operator insists its facilities should be up and running again within days following a cyber attack.
DP World Australia shut down its Sydney, Melbourne, Brisbane and Fremantle port operations after the breach was detected late Friday, leaving cargo and containers stuck on the docks.
The company disconnected its internet connectivity, which stopped ongoing unauthorised access to its network, however, this also resulted in key systems linked to its port operations not functioning normally.
The cyber attack will likely disrupt the movement of goods for at least another few days ahead of the operator's busiest time of the year.
The federal government is helping coordinate the stevedore's response while the Australian Cyber Security Centre is providing technical advice.
The former head of the Australian Cyber Security Centre, Alastair MacGibbon, who is advising DP World, said the number one priority was to get containers moving again.
DP World restricted access to ports 'to safeguard our employees, customers and our networks' as the company investigates
'What we know is there was unauthorised activity in the system,' he told Nine's Today show on Monday.
'A pretty brave and smart move was taken to pull the plug, so to speak, on the internet,' 'What that has done, it's protected the organisation against potential future harm.
'But by its nature, it creates a technical problem when you cut off the internet.
'What we're dealing with here is the consequence of reducing harm, which might sound crazy to you, but it's the safest, smartest thing for all.'
Mr MacGibbon said data was taken by 'someone malicious or unauthorised', but could not say what the nature of the data was.
He also said DP World had been working closely with the government at the weekend and noted that emergency supplies, such as vital medical supplies and equipment, could be picked up 'selectively' from the docks.
Operator DP World decided to shut down its ports in Sydney, Melbourne, Brisbane, and Fremantle
'So they can deal with the most critical matters but .... the vast bulk of cargo, is just stuck at the moment,' Mr MacGibbon said.
DP World is a Dubai-based logistics company which operates cargo and port terminal services both in Australia and internationally.
'Our teams are working diligently to contain the situation and determine the impact on our systems and data,' a company statement read.
'To safeguard our employees, customers and our networks, we have restricted landside access to our Australian port operations while we continue our investigation.
'This is part of a comprehensive response which includes engaging with cybersecurity experts, actively investigating the incident and notifying the relevant authorities.'
The Maritime Union of Australia (MUA) recently voted on industrial action, extending their 24-hour rolling strike notice until November 20.
There's no suggestion the cybersecurity incident and the union actions are linked.