Pacific Tank Lines Data Breach

Akira ransomware claimed Pacific Tank Lines, a company specializing in the transportation of liquid bulk commodities such as petroleum and chemicals via tank truck, on October 2, 2026. The threat actor asserts that corporate data was exfiltrated. This could include sensitive information critical to a hazmat operator, such as detailed manifests, routing plans, driver records, and client delivery contracts. The inclusion of such specialized data suggests a calculated effort to maximize pressure on the victim. Akira is recognized as one of the most active ransomware groups globally, with a persistent focus on the transportation and logistics sector. Their typical modus operandi involves extending the dwell time within a victim’s network to stage large volumes of data for exfiltration before initiating encryption. This strategy leverages the critical nature of delivery obligations for transportation companies, aiming to compel ransom payments by threatening operational disruption and the exposure of proprietary or sensitive logistical information.

SOCRadar’s investigation revealed no direct stealer-log hits associated with Pacific Tank Lines. Potential initial access vectors for the Akira group, as suggested by common threat actor tactics, could include phishing campaigns targeting dispatchers or administrative staff, exploitation of vulnerabilities in fleet management systems or enterprise resource planning (ERP) software, or a compromise through a third-party supplier, such as a fuel or chemical provider, that has integrated system access. Given the nature of Pacific Tank Lines’ operations, specific attention should be paid to the potential exfiltration of hazmat-related data and driver records. The absence of direct stealer-log correlation does not rule out a compromise, as data may reside in other compromised systems or have been staged before detection. Pacific Tank Lines should engage incident response specialists with experience in the transportation sector to thoroughly assess the extent of the breach. This includes verifying what specific data, particularly hazmat manifests and driver information, may have been exfiltrated. Furthermore, the company must comply with regulatory requirements for notifying affected clients and relevant authorities, such as the Department of Transportation, as necessary.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.