Superterminais Data Breach

N0n listed Superterminais on its dark web portal on October 12, 2026. Superterminais is a port terminal operator based in Brazil. The threat actor claimed to have exfiltrated nine employee credentials associated with the domain superterminais[.]com.br. The compromise reportedly affected multi-platform systems, including those used by port operations and logistics staff. As of the reporting date, Superterminais has not issued a public statement regarding this incident. The targeting of a logistics and transportation company aligns with broader trends of ransomware groups focusing on critical infrastructure and supply chain vulnerabilities. The N0n ransomware group has claimed 72 victims within the last sixty days. Their primary targeted sectors include Transportation, Technology, and Healthcare. The group’s operations predominantly focus on victims located in the United States, South Korea, and Brazil. On the same date Superterminais was listed, N0n also claimed other victims in the shipping and logistics sector, including Ocean Network Express (Singapore), CULines (China), T.S. Lines (Taiwan), and ZPMC (China), which operates in the Manufacturing industry. This indicates a pattern of focused attacks against the global transportation and maritime infrastructure.

SOCRadar’s analysis indicates that nine credentials related to Superterminais were recovered, impacting the corporate domain superterminais[.]com.br. The observed compromise spans multiple system types, suggesting infected workstations were actively harvesting information across various platforms simultaneously. The presence of third-party service credentials alongside direct organizational access suggests that the intrusion may have extended beyond the company’s core infrastructure perimeter. Superterminais has not officially confirmed the listing or any data breach. The recovery of credentials, including those for third-party services, highlights a potential vector for ransomware operations, as these credentials could be leveraged for further unauthorized access or for credential stuffing attacks. The compromise of port operations and logistics staff credentials, in particular, raises concerns about the integrity and security of critical infrastructure operations. The absence of a public statement from Superterminais means the full extent and nature of the compromise remain unconfirmed from the victim’s perspective. Action Items: Immediate stealer-log monitoring for superterminais[.]com.br is recommended. Implement phishing-resistant multi-factor authentication on all VPN gateways and remote-access systems. All credentials belonging to port operations and logistics staff should be rotated, and access logs reviewed for the period around October 12, 2026, to identify any anomalous activity.