Supply-chain attack exposes the fragile link in Brazil's critical infrastructure

In October 2026, operations at Santos Brasil, Portonave, and Superterminais came under scrutiny in a security incident, amid suspicion of an attack originating from technology provider CyberLogitec, according to reporting by Exame. The case is not about a port being directly breached: it is about a compromised logistics software vendor whose access spread to those who depend on it.

For those who architect systems that interface with critical infrastructure (energy, ports, sanitation, transportation), this is the detail that matters more than the headline. The entry point was neither the power plant nor the terminal: it was a link in the software supply chain, the same pattern seen in attacks like SolarWinds and Kaseya, only now explicitly mapped in Latin America.

Why industrial systems don't accept patches the way web applications do

A web application tolerates a broken deploy: you roll it back, restart the pod, and the user waits a few seconds. An industrial control system (SCADA, PLC, protocols like Modbus and DNP3) doesn't have that luxury: stopping to apply a security patch can mean stopping a turbine, a container conveyor, or a water treatment plant.

These protocols were designed in the 1980s and 1990s, at a time when the design premise was physical isolation, not authentication. There is no built-in identity verification, no native encryption, and much of the installed base in Brazil still runs on this foundation. Updating it means, in practice, rewriting the trust model of a system that was never meant to be on the internet.

That is why Kaspersky's general manager for the Americas, Cláudio Martinelli, uses Itaipu Binacional, responsible for roughly 10% of all electricity supply in the Brazilian market according to Itaipu's own data, as an example of systemic risk:

If Itaipu is affected by a critical attack, that compromises all of Brazil's energy distribution, because we have a high dependency on Itaipu.

Cláudio Martinelli, general manager for the Americas at Kaspersky

OT/IT segmentation: where architecture decides the blast radius

The most common design flaw in industrial environments is not a lack of firewalls, it's the false sense that operational technology (OT) networks are isolated from corporate (IT) networks just because, in theory, they should be. In practice, telemetry integrations, maintenance ERPs, and management dashboards create bridges that no network diagram documents.

When a third-party vendor like CyberLogitec is compromised, that segmentation is exactly what decides the extent of the damage: an attacker who gets in through the port management system only becomes a physical threat if they can pivot to the network that controls cranes and conveyors. Architecting that boundary with zero trust, dedicated VLAN segmentation, and mutual authentication between services is not regulatory overkill, it's what separates an IT incident from an actual logistics shutdown.

An already well-established practice in critical industrial environments is the use of data diodes: hardware that only allows telemetry traffic in one direction, from the OT network to IT monitoring, with no path back. This solves the classic observability problem in critical infrastructure: the engineering team wants metrics and logs, but can't open a write channel that an attacker could use to send commands in the opposite direction.

The third-party vendor as a vector: what this changes in the architect's checklist

The episode at the Brazilian ports reinforces a point that SBOM (Software Bill of Materials) has been trying to address for a few years without full adoption: every integration with a software vendor is, by definition, an extension of your attack surface. Before approving an integration with a logistics management system, energy provider, or any critical infrastructure operator, the architect should require:

• A documented inventory of the vendor's third-party dependencies (SBOM), not just of the product itself
• Credential segregation: vendor access should never have the same privilege level as internal operations
• An incident response plan that treats the vendor as a possible vector, not as a trusted party by default
• Testing to confirm that a vendor compromise does not automatically propagate to physical control systems

None of these practices is new to anyone working in application security, but most engineering teams still apply them only at the corporate IT perimeter, without extending the same standard to software that talks to OT.

The geopolitical chessboard that changes threat modeling

Kaspersky's Threat Landscape report, presented during Cyber Security Week in Praia do Forte (Bahia), identifies the government sector as the most targeted in Brazil: 26.5% of attacks blocked in the 2025/2026 period, followed by process manufacturing (11.38%) and transportation and warehousing (2.57%). This changes the threat model for anyone building systems for these sectors: the adversary is not always a criminal looking for ransom.

Kaspersky senior researcher Lisandro Ubiedo describes the activity of state-linked groups tied to countries like China and North Korea in the region as silent infrastructure mapping, not isolated attacks:

Kinetic power, meaning a bomb, a weapon, is only the visible plane of this type of warfare. We have cyber warfare, which is a war that runs in parallel.

Lisandro Ubiedo, senior security researcher at Kaspersky

For systems architecture, this means threat modeling that doesn't assume only an opportunistic attacker: it assumes an actor with the time, budget, and patience to spend months mapping a network before acting, which shifts the priority toward long-term logging and detection of slow reconnaissance, not just blocking known exploits.

Where Brazil still falls behind

Martinelli is direct when comparing the country with the United States and Europe, where critical infrastructure defense is treated as a pillar of national security with continuous investment. In Brazil, according to him, awareness of the risk already exists within the defense forces, but preventive action still hasn't kept pace.

For those who build or integrate systems with energy operators, ports, and public services, the practical lesson is not to wait for regulation to arrive: it is to treat every integration with critical infrastructure as if it were already under active attack, with segmentation, vendor SBOM, and unidirectional data flow designed before the first incident, not after it.