Transnet is working to bring its operations back to normal following a cyber attack on Thursday. The South African logistics group said it has found the source but it is yet to identify it and the nature of the attack.

“Transnet has identified and isolated the source of the disruption on its IT systems, and technical teams continue to work around the clock to ensure that the impact remains minimal,” the operator said in a statement released on Friday.

The statement also said Transnet’s manual port and rail operations continued as it prioritised the export of reefer containers, primarily through the Port of Durban. Transnet spokesperson said that since the start of the season in April, reefer container volumes were up 12% from the same time last year.

Operations at Richards Bay, Eastern Cape, the East London and PE Container and Auto Terminals continue manually, while Ngqura and Cape Town container terminals continue to be impacted by high swells.

Durban, Richards Bay and surrounding areas in KwaZulu-Natal province, have been experiencing violent unrest and rioting in protest against the arrest of former president Jacob Zuma.

Gavin Kelly, CEO of the Road Freight Association was quoted saying that “if this matter isn’t addressed urgently, the nonfunctioning of South African ports will be yet another reason international traders and shippers choose other ports in Africa through which to move goods.”

The country’s acting minister Khumbudzo Ntshavheni said the government did not believe the cyber attack on Transnet’s IT infrastructure had been related to last week’s unrest. Transnet’s website remained offline Sunday.