Eurogate Tanger Data Breach

On October 12, 2026, the N0n ransomware group listed Eurogate Tanger on its dark web portal. Eurogate Tanger, a significant deep-sea container terminal in Morocco, operates within the transportation and logistics sector. The incident came to light through SOCRadar’s continuous monitoring of dark web threat actor activities. The listing of Eurogate Tanger, a critical hub for trans-Atlantic and Mediterranean container traffic, suggests potential implications for global supply chains that extend far beyond its operational base in Morocco. The N0n ransomware group has been active, claiming 72 victims over the preceding 60 days. Their primary targets include organizations within the Transportation, Technology, and Healthcare industries. The group’s leading victim countries are the United States, South Korea, and Brazil. Notable co-victims from their recent campaigns include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). Eurogate Tanger’s profile aligns with N0n’s focus on the transportation sector, indicating a pattern of targeting critical infrastructure within this industry.

SOCRadar’s analysis uncovered four employee credentials belonging to Eurogate Tanger within sampled stealer logs. These credentials were found to be associated with container terminal management infrastructure and corporate authentication endpoints. This finding is consistent with post-intrusion credential harvesting tactics often employed by ransomware groups targeting port operations staff, aligning with the broader pattern observed for other N0n victims during the October 12 campaign. The presence of four credentials across both operational and corporate systems suggests more than peripheral exposure, indicating a potential for significant system access. The compromise of credentials for an organization like Eurogate Tanger, which serves as Morocco’s principal deep-sea container terminal and handles substantial international cargo, carries considerable implications for global supply chain security. The potential reach of such an attack extends beyond the immediate operational impact to affect numerous other entities reliant on this critical infrastructure. Therefore, this listing warrants a higher level of concern than the number of exposed credentials might initially suggest. The immediate actions required include rotating all four identified credentials to mitigate unauthorized access. It is also recommended to audit terminal management system access logs for the past thirty days, scrutinize container management and vessel scheduling platforms for any unauthorized sessions, and enforce phishing-resistant multi-factor authentication (MFA) on all port operations authentication systems. Until an internal review can confirm the extent of the compromise and its impact, the situation should be treated as an active incident.