BKH ICD Data Breach

N0n listed BKH ICD, a South Korea-based Transportation organization, on its dark web data-leak portal on October 12, 2026. This listing is part of N0n’s broader maritime campaign, with BKH ICD being one of 72 victims claimed in the sixty days preceding the report. As of the article’s publication, there was no public statement from BKH ICD regarding the incident. The transportation sector, particularly maritime operations, is often targeted due to the critical nature of supply chains and the potential for significant disruption and ransom payouts. N0n’s activity over the sixty days prior to this listing predominantly targeted the Transportation, Technology, and Healthcare industries, with the United States, South Korea, and Brazil being the primary countries affected. Other organizations listed on October 12, alongside BKH ICD, include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). The scale of this single-day campaign suggests a potential list-based targeting approach across the maritime sector, indicating a broad and systematic effort by the threat actor.

Stealer-log queries conducted by SOCRadar returned no indexed records that matched BKH ICD’s operational domains. However, it is important to note that several other organizations listed on the same date, October 12, showed significant credential exposure in the same query sweep. This discrepancy highlights a notable gap in the findings for BKH ICD and should not be interpreted as a clean result or confirmation that the organization is unaffected. Publicly accessible stealer-log aggregators may not capture data from all underground sources or unmonitored stealer families. The absence of indexed records does not rule out credential exposure through private markets or less common data exfiltration channels. Infostealer-harvested credentials can be a crucial