Dongkuk Steel Data Breach

N0n listed Dongkuk Steel on its leak site on October 12, 2026. The South Korean steel manufacturer is one of 72 victims the group claimed in the preceding sixty days. Stealer-log queries for dongkuk[.]com returned eleven employee credentials against corporate identity and operational systems. No public statement from Dongkuk Steel had been issued at publication. N0n’s sixty-day campaign concentrated on Transportation, Technology, and Healthcare, with the strongest geographic presence in the US, South Korea, and Brazil. The October 12 maritime wave put Dongkuk alongside Ocean Network Express (Singapore), CULines (China), T.S. Lines (Taiwan), and ZPMC (China, Manufacturing) — a mix of shipping operators and manufacturers with port and supply-chain exposure.

Eleven employee credentials were recovered against Dongkuk Steel’s corporate identity and operational systems. Dongkuk’s inclusion in a campaign that otherwise targets port operators and container lines reflects N0n’s reach into industrial manufacturers with maritime logistics touchpoints. Eleven hits is consistent with multi-workstation compromise; the operational system credential exposure is the sharper risk for a major steel producer with integrated logistics infrastructure. Dongkuk Steel should audit and rotate credentials flagged in stealer-log data, enforce phishing-resistant MFA on VPN gateways and SSO systems, and review remote-access logs covering the period around October 12.