Portonave Data Breach

N0n listed Portonave, a major Brazilian container terminal, on its dark web leak site on October 12, 2026. Portonave is one of 72 organizations claimed by the group in the preceding 60-day window. There was no public statement from the company at the time of publication. N0n’s 60-day campaign concentrated on the Transportation, Technology, and Healthcare sectors, with the strongest geographic presence in the US, South Korea, and Brazil. Portonave, as a Brazilian port operator, fits directly into N0n’s primary targeting geography. Other victims claimed in the same operational window include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing).

Stealer-log analysis returned two employee credentials against Portonave’s corporate authentication systems. While this is a small sample count, corporate-domain credentials for a major port terminal carry disproportionate risk. Operations staff at such terminals often hold access to critical systems including cargo management, vessel scheduling, and third-party port authority interfaces. Rotate all confirmed exposed credentials. Review remote-access and VPN logs for sessions tied to the affected accounts during the stealer log’s collection window. Enforce phishing-resistant MFA across all access points into terminal operations systems.