Pusan Newport Company Data Breach

N0n claimed Pusan Newport Company, a South Korean container terminal operator, on its dark web portal on October 12, 2026. This listing is part of a broader campaign, with N0n making 72 victim claims in the preceding 60 days. The group has shown a particular focus on the Transportation sector, with maritime operators being a central target. Organizations operating in this sector, especially those in key geographical locations, should consider this an active operational risk that requires immediate attention. N0n’s recent targeting has predominantly focused on the Transportation, Technology, and Healthcare industries. The majority of their claimed victims are located in the US, South Korea, and Brazil. Pusan Newport Company aligns precisely with this profile as a major port operator situated in one of N0n’s prioritized geographies. The threat actor’s pattern of behavior indicates sector-specific targeting rather than random selection. This is further evidenced by other recent claims during the same period, including Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing).

Our stealer-log query targeting Pusan Newport Company’s operational domains returned no records. It is important to note that this result does not constitute confirmation of no compromise. The query is limited by pagination and scope, meaning that potential exposure through regional or private marketplaces falls outside its coverage. The primary indicator of potential compromise remains the listing itself on the N0n’s dark web portal. Even unverified claims from a group with N0n’s claimed victim volume warrant an independent internal review. This review should specifically focus on authentication logs and remote-access systems. N0n’s typical modus operandi involves exploiting harvested credentials obtained from VPN gateways, corporate single sign-on (SSO) solutions, and remote desktop services. This method allows them to bypass traditional perimeter defenses. To mitigate this threat, organizations should implement phishing-resistant multi-factor authentication (MFA) on all remote-access systems and engage in proactive credential monitoring. The critical risk for leadership is not solely the verification of N0n’s claim but rather the organization’s capability to detect an authenticated intrusion before any data exfiltration occurs. Implementing robust monitoring and rapid response mechanisms, alongside strong authentication controls like phishing-resistant MFA, is crucial for defending against this type of threat.