A ransomware attack hit the Port of Vigo, Spain’s largest fishing port, encrypting cargo management systems and port services infrastructure. Cargo operations reverted to manual handling during recovery, creating measurable throughput delays at a facility central to Spain’s fishing and trade supply chain. Threat actor identity and ransomware variant remain unconfirmed; the incident signals continued adversary focus on maritime critical infrastructure where operational downtime carries direct economic consequence.