GlobalNet LCL Data Breach

N0n added GlobalNet LCL to its leak site on October 12, 2026. The Indonesian transportation organization is one of 72 N0n victims in the past 60 days. There has been no public statement from GlobalNet LCL regarding this incident. October 12 appears to have been a significant listing event for N0n, with the ransomware group claiming GlobalNet LCL alongside dozens of other port and shipping operators in a single sweep, indicating a coordinated effort targeting the maritime sector. N0n’s campaign, spanning the last 60 days, has claimed 72 victims, with a focus on the Transportation, Technology, and Healthcare industries. The group demonstrates a strong geographic presence in the U.S., South Korea, and Brazil. Maritime and shipping firms are notably featured in N0n’s recent listings. This aligns with the targeting of GlobalNet LCL, an Indonesian port operator. Other organizations targeted during the same period include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing), suggesting a pattern of targeting critical infrastructure and logistics providers.

Stealer-log queries performed for GlobalNet LCL’s operational domains returned zero records. However, this null result does not definitively confirm that the organization has not experienced a compromise. Other port operators that were listed by N0n in the same October 12 sweep exhibited significant credential exposure, highlighting the potential for such data to be exfiltrated. The absence of records in this specific query may indicate that credentials were exposed through unmonitored stealer families or accessed via private underground markets not covered by this analysis. Therefore, the null result should be treated as a lack of positive detection, not as a confirmation of the organization’s security. The methodology used for this analysis involved querying stealer-log data associated with GlobalNet LCL’s domains. The limitations of this approach are acknowledged: the query might have covered only a limited sample, and credentials could exist under alternate corporate domains or use personal email aliases. Furthermore, records may exist in feeds outside the queried dataset, or credentials might have been used and rotated before being indexed. The absence of evidence in this specific log query is not evidence that no compromise has occurred, leaving room for potential, yet undetected, security incidents. To address potential risks, an internal review of credential and authentication logs focused on the October 12, 2026 window is recommended. This review should identify anomalous access patterns across port authority systems and any shared logistics platforms that might also be used by co-victim shipping lines. Implementing phishing-resistant multi-factor authentication across all network access points is crucial, especially if it is not already in place. The widespread nature of this listing event signifies that numerous organizations require similar security assessments to mitigate ongoing threats.