Dong-A Tanker Data Breach

N0n listed Dong-A Tanker, a South Korean transportation organization, on its dark web data-leak portal on October 12, 2026. This discovery was made by SOCRadar’s Dark Web Team through continuous monitoring of threat actor infrastructure. To date, Dong-A Tanker has not issued a public statement regarding the incident. The transportation sector, particularly in regions like South Korea, often presents attractive targets for ransomware groups due to the critical nature of its operations and the potential for significant disruption. In the sixty days preceding this report, N0n claimed responsibility for 72 victim incidents, primarily targeting the Transportation, Technology, and Healthcare industries. The group’s most frequent victim countries are the US, South Korea, and Brazil. The incident on October 12 appeared to involve a coordinated sweep, affecting multiple maritime operators simultaneously. Other identified victims from this wave include Ocean Network Express (Singapore), CULines (China), T.S. Lines (Taiwan), and ZPMC (China). This broad targeting of the maritime sector suggests a list-based approach rather than individually scoped intrusions.

Queries against Dong-A Tanker’s operational domains using stealer-log data yielded no indexed records. This observation is noteworthy, especially considering that several other victims