NEOM Ports Data Breach

N0n claimed NEOM Ports as a victim on October 12, 2026, listing Saudi Arabia’s prominent giga-project port infrastructure on its dark web leak site. This claim places NEOM Ports among 71 other organizations reportedly targeted by the group. SOCRadar identified two employee credentials associated with NEOM Ports’ corporate authentication endpoints within stealer-log data. While this represents a limited sample, the critical nature of the targeted asset warrants immediate internal investigation rather than a passive monitoring approach. N0n has demonstrated significant activity over the past sixty days, with 72 victim claims. The group primarily targets organizations within the Transportation, Technology, and Healthcare sectors. Their most frequent targets are located in the US, South Korea, and Brazil. The October 12 incident involved a notable surge in maritime-related claims, including Singapore’s Ocean Network Express, China’s CULines and ZPMC, and Taiwan’s T.S. Lines. NEOM Ports aligns with N0n’s expanding focus on infrastructure-related entities, fitting within the group’s observed targeting patterns.

SOCRadar’s threat intelligence analysis uncovered two credentials linked to NEOM Ports that were found in stealer-log data. These logs are often sourced from infostealers that harvest user credentials from compromised endpoints. Ransomware operators frequently acquire these logs from underground marketplaces to bypass initial security controls and gain unauthorized access to corporate networks. The discovery of two valid credentials for NEOM Ports’ systems, despite being a small number, indicates a potential compromise of at least one endpoint. The presence of these credentials suggests a potential avenue for threat actors to circumvent perimeter defenses. While the exact intrusion method has not been confirmed, the acquisition and use of valid employee credentials are a common tactic for gaining initial access. Two working credentials targeting industrial port infrastructure represent a significant foothold, regardless of the overall size of the compromised data set. NEOM Ports has not yet issued a public confirmation regarding this listing. The observed telemetry suggests that NEOM Ports should treat this listing as a credible indication of access. Immediate actions are recommended, including rotating the two identified credentials. Furthermore, a thorough audit of authentication logs on all relevant systems is advised to detect any anomalous access patterns prior to October 12. Enforcing phishing-resistant multi-factor authentication on all external access points connected to port and construction management infrastructure is also a critical step to mitigate further risk.