BMT IQ Data Breach

N0n has listed BMT IQ, a United Kingdom-based organization specializing in marine certification and inspection, on its dark web data leak portal. The listing occurred on October 12, 2026, marking BMT IQ as one of 72 victims claimed by N0n within the sixty days preceding this report. As of the time of publication, BMT IQ has not issued a public statement regarding this incident. The nature of BMT IQ’s operations, which involve critical maritime safety and regulatory functions, could make it a target for threat actors seeking to disrupt or extort organizations within the supply chain or critical infrastructure sectors. N0n’s recent campaign activity, encompassing 72 victims over a 60-day period, shows a diverse targeting strategy across the Transportation, Technology, and Healthcare industries. The United States, South Korea, and Brazil represent the most frequently targeted countries. The listing on October 12, which includes BMT IQ, also saw N0n claim Ocean Network Express (Singapore), CULines (China), T.S. Lines (Taiwan), and ZPMC (China), all entities within the Transportation or Manufacturing sectors. This indicates N0n’s continued focus on global logistics and related industries.

Stealer-log queries conducted for BMT IQ have revealed evidence of credential activity. However, the sampled data did not contain identifiable usernames associated with a corporate domain. This pattern suggests a potential compromise of a workstation used to access maritime surveying and inspection platforms, rather than a direct breach of corporate authentication systems. The compromised credentials appear to be related to external service access. Despite the absence of explicit corporate domain usernames in the sampled data, a foothold on a BMT IQ workstation is significant. This access could provide threat actors with entry into sensitive maritime certification and inspection records. The distinction between external service credentials and direct corporate authentication is less critical in this context, as any unauthorized access to an endpoint could lead to the exfiltration of valuable data. Recommendations: Audit endpoint activity on machines used to access external maritime platforms. Enforce MFA on inspection-system logins and any remote-access tooling. Even without corporate-domain credentials in the sample, a workstation compromise warrants a full internal log review.