Samjoo Maritime Data Breach

N0n listed Samjoo Maritime, a South Korea-based Transportation organization, on its dark web data-leak portal on October 12, 2026. Samjoo Maritime was one of 72 victims claimed by N0n in the sixty days prior to this analysis, and this incident is part of a broader campaign that disproportionately targeted the maritime sector, impacting multiple Korean operators in a single day. As of the time of publication, there has been no public statement from Samjoo Maritime regarding this incident. The N0n ransomware group’s recent activity, within the sixty days preceding this report, has predominantly focused on the Transportation, Technology, and Healthcare sectors. The primary target countries for N0n during this period were the United States, South Korea, and Brazil. The coordinated attacks on October 12, which included Samjoo Maritime, also impacted other significant maritime entities such as Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). The observed pattern suggests N0n may be employing list-based targeting strategies, particularly within the maritime industry.

Stealer-log queries performed by SOCRadar returned no indexed records that matched Samjoo Maritime’s operational domains. It is important to note that this negative finding does not definitively rule out a compromise or confirm the organization is unaffected. Several other co-victims targeted on the same date by N0n, and included in the same query sweep, demonstrated significant credential exposure. The absence of indexed records for Samjoo Maritime could be due to several factors, including the query covering only a paginated or limited sample of available data, the existence of credentials under alternate corporate domains not included in the query, or the possibility that compromised credentials were used and rotated prior to indexing. Data may also not have been indexed yet in the monitored feeds. The lack of direct stealer-log correlation for Samjoo Maritime, while other entities in the same query showed exposure, is noteworthy. Infostealer-harvested credentials can significantly support ransomware operations by providing initial access, facilitating lateral movement, and enabling the evasion of security controls. The observed pattern of N0n’s broader campaign suggests a potential reliance on such compromised credentials, possibly obtained through infostealers or initial access brokers, to gain a foothold within victim networks. This could involve accessing corporate accounts through compromised credentials for services like Microsoft 365, VPNs, or remote-access portals, ultimately leading to ransomware deployment. Given the clean stealer-log result does not dismiss the N0n claim, Samjoo Maritime should undertake an internal review of authentication logs for the thirty days preceding the listing date. An audit of VPN and remote-access endpoints for anomalous sessions is also recommended. If the internal review proves inconclusive, a broader stealer-log sweep, potentially including private markets and less-indexed stealer families, would be the prudent next step.