Ocean Network Express Data Breach

Four employee credentials for Ocean Network Express (one-line[.]com) were discovered in stealer-log repositories, indicating a potential security vulnerability. The ransomware group N0n listed Ocean Network Express (ONE) on its dark web leak site on October 12, 2026. This listing occurred as part of a larger campaign that claimed 72 victims within the maritime sector. At the time of reporting, there was no public statement from Ocean Network Express regarding the incident. The company’s operational scope as one of Asia’s largest container carriers makes its booking and documentation systems, used by numerous freight forwarders, shippers, and port operators, a significant target for cyber threat actors. N0n’s activity over the preceding 60 days involved 72 claims, with a strong focus on the Transportation, Technology, and Healthcare industries. The group’s geographic targeting has shown a notable concentration in the United States, South Korea, and Brazil. In the same campaign window, other maritime-related victims included CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). This pattern of sector clustering suggests a deliberate and strategic targeting approach by N0n, rather than opportunistic attacks.

The discovery of four employee credentials for Ocean Network Express, associated with the domain one-line[.]com, along with external-user records, points to a potential compromise that could facilitate unauthorized access. The presence of these credentials in stealer-log repositories is a common precursor to ransomware attacks, as it can provide threat actors with the necessary access to systems and data. The mixed profile of internal and external credentials is characteristic of employee accounts that have access to both sensitive internal systems and customer-facing platforms. Ocean Network Express, as a major player in the global shipping industry, relies on extensive booking and documentation systems that interface with a wide range of external partners, including thousands of freight forwarders, shippers, and port operators. A credential compromise on ONE’s platform could therefore serve as a pivot point into the broader third-party logistics infrastructure, extending beyond ONE’s immediate network perimeter. The presence of these compromised credentials, while not confirming a full breach or ransomware deployment, significantly raises the risk profile for Ocean Network Express. Such access could enable a threat actor to move laterally within the network, identify critical assets, and deploy ransomware. Therefore, immediate action is recommended to mitigate potential fallout. Recommended Response: Rotate all accounts associated with the one-line[.]com domain. Extend multi-factor authentication (MFA) audits and enforcement to customer-facing portals and booking systems. Conduct a thorough sweep of stealer-log repositories targeting subsidiary and partner domains that share ONE’s authentication infrastructure.