Saehan Marine Data Breach

N0n has claimed Saehan Marine, a Transportation operator based in South Korea, listing the company on its data-leak portal on October 12, 2026. This claim is part of a broader pattern of activity observed by SOCRadar, which has identified N0n as having posted 72 victims in the sixty days preceding this report. The group has shown a significant focus on Korean and US shipping operators, with Saehan Marine being one of several maritime entities targeted in a concentrated campaign. As of the time of this publication, Saehan Marine has not issued a public statement regarding the alleged incident. N0n’s recent campaign activity indicates a pattern of targeting the Transportation, Technology, and Healthcare sectors, with the United States, South Korea, and Brazil being the primary countries of focus. The October 12 incident, which specifically targeted multiple Korean maritime operators simultaneously, aligns with this pattern. Other organizations affected in this wave include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing), highlighting N0n’s strategic focus on the global shipping and logistics industry.

Stealer-log queries related to Saehan Marine’s domains yielded a limited number of records. Crucially, the usernames associated with these records were non-corporate. This indicates that the observed data points to external user activity on organizational platforms rather than direct compromise of employee credentials. Consequently, the immediate risk of intrusion via stolen employee authentication methods is considered limited based on this specific telemetry. Despite the non-corporate nature of the stealer-log records, the nature of ship agency operations, which involves privileged access to carrier and port authority systems, necessitates further investigation. A credential audit beyond the scope of this initial sample is strongly warranted. The presence of non-corporate credentials on organizational platforms could still point to vulnerabilities in access control or misconfigurations that attackers might exploit, even if direct employee credential theft is not evident from the current data. Recommendations: Enforce phishing-resistant multi-factor authentication (MFA) across all VPN gateways and single sign-on (SSO) systems. Conduct a comprehensive stealer-log sweep covering Saehan Marine’s primary domain. Additionally, extend this monitoring to any carrier portal accounts utilized by staff. The pattern of non-corporate credentials identified does not negate potential security risks; rather, it shifts the audit focus toward third-party access and external-facing services to ensure robust security posture.