NCT Kandla Data Breach

N0n ransomware actors listed NCT Kandla, an India-based port terminal operator, on their leak site on October 12, 2026. This incident places NCT Kandla among the group’s 72 claimed victims within the preceding sixty days. While the specific sector of NCT Kandla (transportation) may not be the primary target of N0n, the group has demonstrated a broad interest across various industries, including Transportation, Technology, and Healthcare. The organization has not publicly commented on the listing, and no direct confirmation of a breach has been issued. N0n’s recent campaign activity shows a significant focus on organizations located in the US, South Korea, and Brazil. The October 12 listing was part of a larger wave that also affected prominent maritime companies such as Ocean Network Express (Singapore), CULines (China), T.S. Lines (Taiwan), and ZPMC (China), which operates in the Manufacturing sector. This diverse targeting suggests N0n’s opportunistic approach to ransomware and extortion, potentially preying on organizations with valuable data or critical infrastructure.

Accessible stealer-log repositories did not yield any records matching NCT Kandla’s operational domains. However, this absence of evidence does not confirm that the organization is unaffected. Several other entities listed in the same October 12 batch exhibited notable credential exposure. Therefore, the null result for NCT Kandla should be interpreted as a reflection of the limitations of the queried data sources rather than definitive proof of no compromise. It is possible that credentials related to NCT Kandla exist within private stealer-log channels or belong to stealer families not covered by the conducted sweep. The nature of infostealer malware is to harvest credentials which can then be leveraged by ransomware operations for initial access, account validation, or to facilitate lateral movement within a compromised network. Such exposed credentials may originate from various sources including Microsoft 365, VPNs, or other remote-access portals. The listing by N0n warrants treating this incident as a credible access event. NCT Kandla is advised to conduct a thorough internal credential audit, meticulously review authentication logs for the period surrounding October 12, and implement phishing-resistant multi-factor authentication (MFA) across all remote access and identity management systems.