J.B Hunt Data Breach

Whitearmor listed J.B. Hunt on its dark web portal on October 26, 2026, and the listing was identified through SOCRadar’s Dark Web Monitoring service. J.B. Hunt is a transportation company based in the United States, and its logistics profile places it squarely within the sector the group has been targeting most aggressively. The claim was accompanied by fresh stealer-log records surfacing against the company’s SSO infrastructure, adding a time-critical dimension to an already significant listing. The listing fits a clear and recent pattern of Whitearmor activity. In the prior 60 days, the group claimed seven other victims, concentrated in the United States, Argentina, and China, with primary sectors spanning Transportation, Technology, and Government & Defense. Recent co-victims include LoveSac, Whirlpool, Partido Liberal, and Ooredoo Myanmar. J.B. Hunt’s transportation profile is a direct match for Whitearmor’s dominant sector focus, meaning the company aligns closely with both the geographic concentration and the industry preferences the group has demonstrated in its recent operations.

SOCRadar’s stealer-log query for jbhunt[.]com returned 25 records. Of these, five are confirmed employee credentials (category A) logged directly against sso.jbhunt[.]com, J.B. Hunt’s SSO infrastructure. Additional records carry @jbhunt.com usernames against third-party services, and seven records have masked or unclear usernames requiring further investigation to classify. This classification is classified as high severity and time-critical given the direct hits against the company’s single sign-on environment. The insert dates are the critical detail: the records span October 23–26, 2026, immediately surrounding the Whitearmor listing. Fresh category A hits against SSO infrastructure at the moment of a ransomware claim is described as the signature of active pre-positioning, not coincidence. While the stealer-log evidence does not confirm that these specific credentials were used by Whitearmor, the pattern is consistent with the typical kill chain for this class of incident. Infostealer-harvested credentials against SSO portals can provide attackers with the corporate account access needed to move toward ransomware deployment, and the timing of the records means defenders should treat the exposure as an active intrusion risk rather than a historical artifact. Immediate actions supported by this analysis include rotating all credentials flagged in this pull, auditing sso.jbhunt[.]com access logs and the M365 tenant for unauthorized sessions in the October window, initiating a threat hunt across affected endpoints, and assessing breach notification obligations. Because the stealer-log query reflects the indexed dataset available at the time of the pull, continued dark web and stealer-log monitoring, along with proactive credential-hygiene checks, remain warranted to catch any additional records that may surface.