BNCT Busan New Container Terminal Data Breach

N0n has claimed BNCT Busan New Container Terminal, a South Korean container terminal operator, as a victim, listing the company on its dark web leak site on October 12, 2026. This listing positions BNCT as one of 72 entities claimed by the group within a 60-day campaign window. Notably, BNCT was part of a batch of claims made on that date which included several other Korean maritime organizations. As of the time of this report, there has been no public statement from BNCT regarding the alleged incident. The company’s operation at Busan, South Korea’s busiest port and a critical hub for Asia-Pacific container trade, likely makes it an attractive target for ransomware and extortion activities due to its significant role in global logistics. N0n’s recent campaign activity over the past 60 days has primarily targeted organizations within the Transportation, Technology, and Healthcare sectors. Geographically, the group has shown a preference for South Korea, the United States, and Brazil. BNCT’s inclusion aligns with N0n’s documented focus on Korean transportation entities during this period. Other organizations claimed within the same campaign window include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). This pattern suggests a consistent targeting strategy by N0n, leveraging the critical infrastructure and trade routes associated with the maritime industry.

SOCRadar’s investigation involved querying accessible repositories for credential records associated with BNCT’s operational domains. The results of these queries returned no matching credential records. However, a null result in stealer-log databases does not definitively clear an organization of compromise. The indexed data sources do not encompass all private stealer markets, and the presence of other victims from the October 12 listing who did show evidence of credential exposure within the same sweep suggests that the absence of data may be due to coverage limitations rather than a lack of compromise. BNCT operates a critical piece of infrastructure at Busan, South Korea’s largest port, playing a vital role in the Asia-Pacific container trade. This strategic importance makes it a potential target for threat actors like N0n, regardless of the specific findings from our current stealer-log query. The connection between infostealer-harvested credentials and the potential for ransomware operations is well-documented, as such credentials can provide initial access or facilitate lateral movement within a compromised network. Recommended Actions: Given the N0n listing and the possibility of credential exposure, it is recommended that BNCT conduct a thorough internal credential audit and review access logs. Rotating remote-access and VPN credentials should be a priority. Furthermore, enforcing phishing-resistant multi-factor authentication on all terminal management and administrative systems is crucial. The absence of visible stealer-log records is not sufficient due diligence in this scenario, and proactive security measures are essential.