Santos Brasil Data Breach

N0n ransomware has claimed to target Santos Brasil, identified as Brazil’s largest port operator. The claim was observed on October 12, 2026, when the organization appeared on N0n’s dark web leak site. Santos Brasil plays a critical role in managing terminal operations at the Port of Santos, which is the busiest port in Latin America. The attack vector appears to involve compromised credentials, as two employee credentials associated with the domain santosbrasil[.]com[.]br were found in stealer-log repositories. This finding is part of broader credential exposure activity observed by SOCRadar. The nature of Santos Brasil’s operations, which include managing cargo documentation and shipping clearance, makes it a potentially high-value target due to the critical role it plays in supply chains. The N0n ransomware group has shown significant activity, claiming 72 victims over the preceding 60 days. Their primary targeting focus lies within the Transportation, Technology, and Healthcare sectors. Brazil has emerged as one of the top three geographies frequently targeted by N0n, indicating that Santos Brasil aligns with the group’s established pattern of operations. Notable co-victims within this timeframe and in the Transportation sector include Ocean Network Express, CULines, T.S. Lines, and ZPMC. This pattern suggests a consistent interest by N0n in organizations operating within the global logistics and shipping infrastructure.

SOCRadar threat intelligence identified two direct corporate credentials linked to the santosbrasil[.]com[.]br domain within stealer-log repositories. This observation, coupled with broader mixed-source credential exposure, suggests that personal or Software-as-a-Service (SaaS) credentials associated with compromised endpoints may also be at risk. The implications of compromised access to port authority and terminal management systems are significant. These systems are integral to critical workflows such as cargo documentation and shipping clearance. Unauthorized access or disruption could lead to supply chain disruptions extending beyond Santos Brasil itself, impacting regional and international trade. The presence of compromised credentials, even if limited to specific accounts, indicates a potential avenue for further intrusion. Such credentials can be leveraged by threat actors to gain initial access, move laterally within the network, and deploy ransomware. The strategic importance of the Port of Santos, as Latin America’s busiest port, amplifies the risk associated with any successful compromise. Disruption of operations could have far-reaching economic consequences. Given the critical nature of the targeted systems and the potential for wider supply chain impacts, immediate action is recommended. This includes forcing credential rotation for all confirmed compromised accounts, reviewing authentication logs for suspicious activity on terminal management and cargo documentation platforms around the time of the N0n listing, and enforcing phishing-resistant multi-factor authentication (MFA) across all access points. In light of the port’s regional significance, coordination with Brazilian port authority security contacts should be considered if unauthorized access to terminal systems cannot be definitively ruled out.