Malaysia's Port of Tanjung Pelepas suspended container terminal operations after a cyber incident was detected at 23:34 local time on 9 September; a phased restart began the next day, with manual gate-in for export containers from 19:30 on 10 September. PTP handled a record 14,028,375 TEU in 2025 and the wider Johor complex 15.1m TEU, making it a key node in the Maersk-Hapag-Lloyd Gemini network. No queues formed at anchor, but the 15,226 TEU Maersk Hanoi deviated about 10 hours in the Malacca Strait.
Supply Chain Action Points
What this means for your business — and what to do about it:
Malaysia's Port of Tanjung Pelepas (PTP) suspended container terminal operations after a cyber incident was detected at 23:34 local time on 9 September. A phased restart began the following day, and manual gate-in for export containers only opened at 19:30 on 10 September, roughly 20 hours after the terminal stopped taking boxes.
The scale is what makes it matter. PTP handled a record 14,028,375 TEU in 2025 and the wider Johor port cluster 15.1m TEU, and it is a key node in the Maersk and Hapag-Lloyd Gemini network, so a gate outage there propagates along transhipment routes rather than staying local. No queues formed at anchor, which is the good news, but the 15,226 TEU Maersk Hanoi still deviated about 10 hours in the Malacca Strait.
Manual gates are not a slower version of normal gates. They are a different process, with earlier cut-offs, paper documentation that has to be complete on the first attempt and a fraction of the throughput. The five sections below set out what that means for each role, with dated actions.
For Exporters
PTP suspended container terminal operations after a cyber incident was detected at 23:34 local time on 9 September, and manual gate-in for export containers only opened at 19:30 on 10 September. That is a window of roughly 20 hours in which no export box could gate in normally, followed by a manual process with lower throughput, longer cut-offs and a paper trail that has to be right the first time. PTP moved a record 14,028,375 TEU in 2025 and the wider Johor complex 15.1m TEU, and it is a key node in the Maersk and Hapag-Lloyd Gemini network, so the disruption travels through transhipment rather than staying local.
Quantify it. Assume you route 15 FEU a week through PTP, average cargo value USD 40,000 per FEU, and manual gate-in adds 60 minutes per box with the cut-off pulled from 20:00 to 17:00. The extra gate time is 15 hours a week of labour and truck waiting. Add dwell at USD 60 per FEU per day and the carrying cost of USD 600,000 of cargo at 8% a year, roughly USD 131 a day, and the week costs 15 x 60 + 917 = about USD 1,817, or USD 7,800 a month on stated assumptions. Miss the vessel and the penalty is not a day: on a Gemini loop the next call is typically a week out, and that is the number to put in front of a planner.
Do this. By 16 September, move your PTP cut-off from 20:00 to 17:00 and tell every shipper and trucker in writing, because a manual gate does not forgive a late box. Pre-lodge customs data and shipping instructions 48 hours before vessel arrival so the paper documents are complete before the terminal asks for them. Hold 20% of Malaysian volume on Port Klang or Singapore as a live alternate rather than a theoretical one, and run one real booking on it this month to prove the routing works. Name one owner for port contingency with the authority to divert without calling a meeting.
Alternatives cost money. Diverting to Port Klang or Singapore adds a transhipment leg, extra terminal handling and one or two days of transit, and space is not guaranteed when a large share of the market diverts at once. Air freight protects the promise and destroys the margin on anything bulky. Shipping earlier is free until it is not, because it locks up working capital. The traps are treating a manual gate as a slow version of a normal gate, assuming a cyber incident qualifies as force majeure when no anchor queue ever formed, and discovering afterwards that your VGM and seal declarations were captured in the system that went offline.
- By 16 September, move the PTP export cut-off from 20:00 to 17:00 and notify every shipper and trucker in writing
- Pre-lodge customs data and shipping instructions 48 hours before vessel arrival
- Keep 20% of Malaysian volume on Port Klang or Singapore and run one live booking there this month
- Appoint one port contingency owner with authority to divert without an approval meeting
- Confirm in writing whether your carrier treats a cyber outage as force majeure before you rely on it
For Cross-Border E-commerce
Ecommerce sellers restocking into Malaysia and Singapore are hit on the head-haul leg, not the last mile. PTP stopped container operations after the incident was detected at 23:34 local time on 9 September and only opened manual export gate-in at 19:30 on 10 September, and manual gate-in runs at a fraction of normal throughput. PTP handled a record 14,028,375 TEU in 2025 and the Johor cluster 15.1m TEU, so even a 20-hour gate stop backs up feeder connections for days. There were no queues at anchor, which means the ships kept moving while the boxes did not.
Model the cover. Assume a regional fulfilment centre doing 1,200 orders a day, 25 days of safety stock, one container supporting 20 days of sales and a USD 22 landed cost per unit. Two extra days of head-haul transit forces cover to 27 days, and a prudent planner will go to 29. The extra four days is 4 x 1,200 x USD 22 = USD 105,600 of working capital tied up in one lane, before the cost of a promotion slot you cannot fill. If the slip runs to five days the figure is USD 132,000, and the SKUs that run dry are almost always the fast movers you least want empty.
Concrete moves. By 17 September, tier regional SKUs by velocity and give only the top sellers premium head-haul routing, with slower lines taking the cheapest available slot. Raise safety stock from 25 to 29 days for any SKU selling over 200 units a week. Hold a live alternate booking through Port Klang or Singapore on every replenishment cycle so the option exists before you need it. By 24 September, set a hard rule that any SKU with under 14 days of cover ships expedited whatever the freight differential, and write the port of entry into the planner next to the vessel name.
Fallbacks have prices. Air bridging best-sellers protects revenue at five to nine times the sea unit cost, which breaks any SKU under about 45% gross margin. Pre-positioning stock in a Singapore third-party warehouse buys two or three days of control for a monthly storage floor. The mistakes are specific: assuming normal gate throughput resumes the moment the terminal reopens, keeping the platform promise date unchanged while the container is four days late, and measuring the delay from vessel arrival instead of gate-in, which is where the manual process actually bites. Keep the promise date and the working stock level in the same document, because the two move together and separating them is how a stockout becomes a refund.
- By 17 September, tier regional SKUs by velocity and route only top sellers on premium head-haul slots
- Raise safety stock from 25 to 29 days for any SKU selling over 200 units a week
- Hold a live alternate booking through Port Klang or Singapore on every replenishment cycle
- From 24 September, ship expedited any SKU with under 14 days of cover regardless of freight difference
- Measure delay from gate-in rather than vessel arrival when updating promise dates and promotion slots
For Manufacturing Plants
Factories drawing feedstock through PTP should treat the 9 September incident as a lead-time input rather than a one-off. The terminal stopped after the incident was detected at 23:34 local time, and manual export gate-in only opened at 19:30 on 10 September. PTP moved a record 14,028,375 TEU in 2025 and the Johor complex 15.1m TEU, and it anchors the Gemini network, so an outage arrives as feeder delay, berth-window reshuffling and containers landing out of sequence rather than as a clean two-day slip. The 15,226 TEU Maersk Hanoi deviating about 10 hours in the Malacca Strait is the reminder that vessels protect their own schedule at the expense of your connection.
Size the exposure. Assume your plant consumes 20 FEU of feedstock a week, one day of output is worth USD 200,000 and contribution margin is 30%. A two-day inbound slip needs about 5.7 FEU of extra cover, so six containers at USD 50,000 each, roughly USD 300,000 of inventory, which is a balance-sheet item you recover later. A line stop does not come back: one day at USD 200,000 of output and 30% contribution is USD 60,000 of lost contribution, and five stopped days cost more than the entire buffer. The buffer also covers the next incident, which on this evidence is a question of when rather than whether.
Sequence it. By 16 September, list every inbound material by port of entry and flag anything routed through PTP with under ten days of cover. By 22 September, make Pasir Gudang, Port Klang or Singapore the default lane for that flagged volume and keep PTP for cargo with genuine float, then run one live booking on the alternate to prove the routing before you depend on it. Raise safety stock on single-sourced parts from 10 to 15 days. Move critical spares and line-stopping items to air from 1 October, and put PTP gate status on the production planning agenda with one named owner for re-planning.
Alternatives are not free. Shifting to Port Klang or Singapore adds a transhipment and one to two days, and if a large share of the market shifts at the same time the space will not be there. Holding more feedstock consumes cash but is recoverable, while lost output never is. Reshoring or dual-sourcing a component removes the port risk and takes six to ten weeks of qualification. The traps are assuming manual gates restore normal throughput on day one, building the buffer in the wrong part number, and letting a critical spare ride the same routing as bulk material because nobody classified the inbound by criticality.
- By 16 September, list all inbound material by port of entry and flag PTP-routed items with under ten days of cover
- By 22 September, switch flagged volume to Pasir Gudang, Port Klang or Singapore as the default lane
- Raise safety stock on single-sourced components from 10 to 15 days
- From 1 October, move critical spares and line-stopping items to air
- Rank inbounds by criticality so critical spares never share routing and priority with bulk material
For Brand Owners
For a brand, the PTP incident is a promise issue first and a cost issue second. The terminal suspended container operations after the incident was detected at 23:34 local time on 9 September and manual export gate-in resumed only at 19:30 on 10 September. PTP handled a record 14,028,375 TEU in 2025 and 15.1m TEU across the Johor cluster, and it is a key node in the Maersk and Hapag-Lloyd Gemini network. Crucially, no queues formed at anchor, which gives carriers a defensible argument that this was not a congestion event, so contractual relief may not respond even though customers still received late deliveries.
Put a number on the customer side. Assume 60,000 orders a month across Malaysia and Singapore, 40% of them replenished through PTP, and a two-day head-haul slip that pushes 5% of the affected orders past the promise. That is 24,000 affected orders and 1,200 late ones. If a fifth of those customers claim a USD 8 credit, that is USD 1,920, and a one-point rise in returns on the same cohort, 240 orders at a USD 35 average price and 40% margin, costs another USD 3,360. The combined USD 5,280 a month is small against the freight bill and large against the repeat-purchase rate you quietly lose.
Three steps. By 17 September, tier the delivery promise by market rather than quoting one window everywhere, and publish the longer window where replenishment runs through PTP. By 22 September, require weekly port and gate status from your 3PL or forwarder, written into the SLA rather than sent informally, so you learn about a slip before your customers do. From 1 October, apply an allocation rule that gives any channel with a fixed delivery commitment first claim on arriving stock, and require the fulfilment partner to report gate-in to shelf availability on the affected lanes.
Alternatives each cost something. Stretching the promise window protects the experience and hands competitors a shorter number to quote against. Absorbing the delay and paying credits protects the promise and eats margin. Pre-positioning inventory offshore buys control and adds a storage line. The pitfalls are specific: changing the promise without changing the listing, the advertising and the service script in the same release; assuming a cyber incident at a terminal qualifies as force majeure when no anchor queues formed; and letting a direct channel run dry while a wholesale channel stays full, which moves stock to the lower-margin side of the business. Decide who owns the customer message before the delay is confirmed, because the message is the part customers actually judge.
- By 17 September, tier delivery promises by market and publish the longer window where PTP replenishment applies
- By 22 September, write weekly port and gate status reporting into the 3PL or forwarder SLA
- From 1 October, give channels with fixed delivery commitments first claim on arriving stock
- Report gate-in to shelf availability for affected lanes alongside fill rate and return rate
- Release listing, advertising and customer service script changes in the same update as any promise change
For Procurement Teams
Procurement should treat the PTP incident as a single-point-of-failure finding, not an operational hiccup. The terminal suspended container operations after an incident detected at 23:34 local time on 9 September and only offered manual export gate-in from 19:30 on 10 September. PTP moved a record 14,028,375 TEU in 2025 and the Johor complex 15.1m TEU, and it is a key node in the Gemini network, which is exactly why a two-day event there can outlast its own duration. No queues formed at anchor, so carriers have a defensible argument that this was not congestion, and your service-level clause may simply not respond.
Model the premium. Assume 1,200 FEU a year through PTP at USD 1,100 per FEU, or USD 1.32m of annual freight. Moving 20%, that is 240 FEU, to Port Klang or Singapore at a USD 150 per FEU premium costs USD 36,000 a year, about 2.7% of that freight spend, and it buys an active second route and a tested diversion plan. Compare that with one missed Gemini call, where the next sailing is typically a week out: one week of delay across 20 boxes at USD 40,000 of cargo value and an 8% carrying cost is USD 1,750, and the operational damage is larger than the number.
Three dated actions. By 18 September, put port contingency into the carrier scorecard with two named alternate ports per lane and a monthly reviewed trigger. By 25 September, negotiate a port-substitution and cyber-incident clause that lets you divert without a rate reset, and confirm in writing whether carrier liability responds when no anchor queue forms. By 30 September, run one live diversion booking so the process is tested rather than merely documented. Name one owner for route risk and require the carrier to report terminal system status alongside schedule reliability.
Alternatives and their costs. Splitting volume across PTP, Port Klang and Singapore builds resilience and dilutes your volume leverage at each port. Buying schedule protection in the contract rather than in inventory protects the plan and costs a premium. Insisting on cyber cover puts the issue on the carrier's balance sheet and will probably raise the rate. The traps are contracts with a congestion clause but no cyber clause, minimum-volume commitments that keep billing while volume is diverted, port-substitution rights with no notice period, and a diversion plan that has never been executed, which is not a plan at all. Put the second lane on the scorecard at the next quarterly review rather than waiting for the annual tender, because the next outage will not fit your calendar.
- By 18 September, put port contingency into the carrier scorecard with two named alternate ports per lane
- By 25 September, negotiate a port-substitution and cyber-incident clause that allows diversion without a rate reset
- Confirm in writing whether carrier liability responds when no anchor queue forms
- By 30 September, execute one live diversion booking so the process is tested rather than documented
- Replace congestion-only clauses with wording that also covers terminal system outages
- Name one owner for route risk and require terminal system status to be reported with schedule reliability