Korea Ferry Data Breach

The maritime hack-and-list campaign attributed to the threat actor N0n, which began on October 12, 2026, impacted dozens of shipping operators in Asia within a single day. Korea Ferry was among the claimed victims, listed alongside 71 other organizations. This incident highlights a significant impact on South Korea’s transportation sector, which appears to be N0n’s primary focus during the observed sixty-day period. The company’s operational domain and potential attractiveness for ransomware activities stem from its role in the critical transportation infrastructure. N0n claimed a total of 72 victims in the sixty days leading up to this report. The primary industries targeted by the group are Transportation, Technology, and Healthcare, with the United States, South Korea, and Brazil being the most frequently victimized countries. Other organizations included in the same October 12 batch as Korea Ferry were Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). This broad targeting suggests a widespread campaign rather than a specific operation against Korea Ferry.

SOCRadar’s analysis of stealer logs revealed one employee credential associated with Korea Ferry’s primary domain. Additionally, a broader set of external-user and third-party credentials were found. While a single corporate credential is a minimal indicator, the presence of external and third-party records from the same endpoint suggests a potential compromise of a workstation that was actively collecting credentials from multiple platforms. This mixed profile is indicative of a post-intrusion environment where lateral movement may have commenced but is not yet complete. The existence of compromised credentials, particularly when found alongside other user and third-party records, raises concerns about the potential for unauthorized access and further exploitation. Infostealer-harvested credentials can be a significant enabler for ransomware operations, providing threat actors with the means to gain access to corporate networks, escalate privileges, and deploy malicious payloads. The presence of these indicators does not confirm that Korea Ferry has been breached by N0n, but it does suggest a potential entry point that warrants further investigation and mitigation. It is crucial for Korea Ferry to identify the specific workstation associated with these compromised credentials. Subsequent steps should involve investigating all other platforms accessed by that machine and treating those credentials as potentially exposed. Expanding the stealer-log query to encompass staff personal accounts and third-party portals is also recommended, as the current sample may be limited, and additional records could exist outside of it. Proactive monitoring for any further indicators of compromise and a review of access controls are essential measures.