Global Terminal Services Data Breach

Global Terminal Services, a company operating in the port and terminal logistics sector, has been targeted by the Deadlock ransomware group. The incident was identified through SOCRadar’s Dark Web Monitoring service, which detected listings on August 19, 2026. The targeting of Global Terminal Services aligns with Deadlock’s operational patterns, as companies in the transportation and logistics industry, particularly those handling sensitive data such as shipping manifests, cargo contracts, and commercial transit records, are often considered high-value targets. The urgency for port operators to restore services also makes them susceptible to extortion pressures. The Deadlock ransomware group has demonstrated a consistent targeting strategy over the past 60 days, focusing on organizations in Turkey, Taiwan, and the MENA corridor. Their victimology includes entities in the transportation, government-adjacent, and industrial sectors. The inclusion of Global Terminal Services in Turkey and UFOC in Taiwan fits within this established pattern, highlighting the group’s dual-region focus across the Eastern Mediterranean and Asia-Pacific. This strategic alignment suggests that Global Terminal Services’ operational profile and geographic location make it a congruent target for Deadlock’s ongoing campaign.

SOCRadar’s investigation involved a stealer-log query against the domain globalterminalsservices[.]com[.]tr. The query returned no records, indicating no direct evidence of compromised credentials associated with this specific domain in the queried dataset. However, it is crucial to note that a null result does not equate to a clearance of the organization’s security posture. The absence of indexed credentials does not rule out a potential compromise. Compromised credentials may exist in other data feeds not covered by the query, potentially using alternative corporate domains, or associated with personal email aliases used by employees. Furthermore, logs of credential usage might have been rotated or are yet to be indexed by the stealer-log feeds. Infostealer-harvested credentials are a known initial access vector for ransomware groups such as Deadlock. These credentials, often sourced from underground marketplaces by initial access brokers, are validated and then sold to ransomware operators. Such access can be leveraged to target corporate accounts, gain entry through Microsoft 365, VPNs, or other remote access portals, facilitating the deployment of ransomware. Therefore, the lack of stealer-log records for globalterminalsservices[.]com[.]tr does not preclude the possibility of credential compromise through these or other means, which could potentially support an intrusion into Global Terminal Services’ network.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.