Camellia Line Data Breach

On October 12, 2026, Camellia Line, a Japanese company specializing in maritime ferry and RoRo services connecting Japan and Korea, was listed on the N0n ransomware group’s dark web portal. SOCRadar’s threat intelligence identified this listing as part of a broader campaign targeting the maritime transportation sector. N0n claimed Camellia Line among 72 victims over the preceding sixty days, with a notable focus on Korean and US transportation firms. The nature of Camellia Line’s operations, which involve critical aspects of shipping logistics like vessel scheduling and port clearance, presents a valuable target for threat actors seeking to disrupt operations or extort payment. This incident is part of a larger pattern of activity by N0n, which has shown a clear preference for targeting the transportation industry, particularly in Korea and the United States. The inclusion of Camellia Line in this recent sweep, alongside other notable maritime companies such as Ocean Network Express, CULines, T.S. Lines, and ZPMC, suggests a sector-wide targeting approach rather than individual company selection. This broad strategy implies that organizations within the maritime logistics chain are at increased risk, regardless of their specific size or operational nuances.

SOCRadar’s analysis of stealer logs revealed one employee credential associated with Camellia Line’s systems. This credential was found alongside broader external and mixed-source records originating from the same endpoint. While a single credential might initially seem insignificant, its presence on a workstation that was potentially already compromised raises concerns. The affected workstation had access to sensitive operational systems, including vessel scheduling, port clearance, and Japan-Korea shipping route management, indicating that even a limited number of exposed credentials can provide significant operational value to threat actors. The exposure of this single corporate credential on a compromised workstation highlights the potential attack pathway for ransomware operations. The sampled stealer logs may only offer partial visibility, and further investigation into wider queries covering personal accounts and third-party portals could reveal additional compromised credentials. It is crucial to acknowledge the limitations of this data; the absence of extensive records does not confirm that a broader compromise has not occurred. The compromised workstation’s access to critical maritime logistics systems makes it a high-value target for further exploitation. The immediate recommended action is to identify the compromised workstation, rotate the exposed credential, and thoroughly audit all platforms and services accessed by that machine. Organizations should not assume that limited credential exposure indicates a limited compromise. Continued monitoring of dark web portals and stealer-log feeds is advised, alongside proactive credential hygiene checks, including password rotation and multi-factor authentication review for all critical access points like Microsoft 365, VPNs, and remote-access portals.