Samudera Data Breach

N0n listed Samudera on its leak site on October 12, 2026. The Singapore-based coastal shipping operator is one of 72 victims the group claimed in the preceding sixty days. Stealer-log queries returned ten employee credentials against Samudera’s systems, with additional mixed-source credential activity indicating exposure across third-party maritime platforms as well. No public statement from Samudera had been issued at publication. N0n’s sixty-day campaign concentrated on Transportation, Technology, and Healthcare, with the strongest geographic presence in the US, South Korea, and Brazil. Other maritime victims from the same period include Ocean Network Express (Singapore), CULines (China), T.S. Lines (Taiwan), and ZPMC (China, Manufacturing).

Ten employee credentials were identified for Samudera alongside broader mixed-source credential activity. As a regional coastal carrier in Southeast Asia, Samudera’s exposed access likely touches vessel operations, freight management, and port agency systems. The mixed credential profile — internal infrastructure plus third-party maritime platforms — indicates infected workstations harvesting across multiple system types during the intrusion window. That’s a wider blast radius than the raw employee count suggests. Samudera should audit credentials across its corporate domains, rotate any accounts appearing in stealer-log data, and enforce phishing-resistant MFA on remote-access and identity systems. Third-party maritime platform credentials warrant the same scrutiny as internal ones given the mixed-source profile.