ILCS Pelindo Data Breach

N0n added ILCS Pelindo to its dark web leak site on October 12, 2026. The Indonesian port logistics company is one of 72 victims N0n claimed in the preceding 60 days. Eight employee credentials tied to internal port operations turned up in stealer-log queries, indicating a potential compromise. N0n concentrated its campaign on Transportation, Technology, and Healthcare sectors, with its densest victim count in the US, South Korea, and Brazil. Alongside ILCS Pelindo, the group claimed Ocean Network Express, CULines, T.S. Lines, and ZPMC, suggesting a deliberate focus on the maritime supply chain.

Eight credentials were found through stealer-log queries, all authenticating against ILCS Pelindo’s own systems. These are workstation-level compromises affecting staff with direct access to port operations and logistics management platforms. The timing of these credential findings aligns with N0n’s claimed breach window, fitting the pattern where infostealers harvest data before or during ransomware deployment. Ransomware operators leverage stealer logs to bypass perimeter defenses. Infected endpoints capture VPN credentials, SSO tokens, and remote desktop passwords that are then sold or traded, allowing threat actors direct access into enterprise environments without triggering alerts. The discovered credentials for ILCS Pelindo suggest this pathway may have been utilized. Continuous credential monitoring, phishing-resistant MFA on all remote-access systems, and regular stealer-log sweeps are recommended countermeasures against this type of threat.