T2S Data Breach

N0n listed T2S, a Brazil-based Transportation organization, on its dark web data-leak portal on October 12, 2026. T2S is among the 72 victims N0n claimed in the sixty days preceding this report. At the time of publication, there was no public statement from T2S. N0n’s campaign over the past sixty days has primarily targeted the Transportation, Technology, and Healthcare sectors. The United States, South Korea, and Brazil have emerged as the top three target countries, with T2S’s listing aligning with N0n’s focus on Brazil. Other organizations claimed in the same operational period include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). This batch of alleged victimizations on October 12 was notable for its heavy focus on maritime entities and its multi-country scope.

Stealer-log queries for the domain t2s[.]com[.]br returned eleven employee credentials. These credentials span T2S’s terminal systems and operational infrastructure, covering authentication systems and internal applications across multiple endpoints. The presence of eleven credentials across various platforms suggests a widespread workstation compromise rather than an isolated incident. This breadth of harvested information indicates that N0n likely possessed sufficient access to enumerate multiple organizational systems prior to the data-leak listing. The exposure of eleven employee credentials related to port terminal operations represents a significant security concern. T2S personnel utilize these credentials to access critical systems, including cargo management, terminal operating systems, and vessel scheduling platforms. Such credential theft provides an attacker with considerable visibility into port operations before the deployment of ransomware. This scenario is consistent with targeted efforts to gain access to the terminal’s most operationally sensitive systems. Next Steps: Rotate all eleven exposed credentials immediately. Audit authentication logs for T2S’s terminal management and cargo systems for the thirty days preceding October 12. Enforce phishing-resistant MFA on all remote-access and internal application logins. Engage an incident response team if log review surfaces unauthorized access events, as the volume of compromised credentials warrants treating this as an active compromise until definitively ruled out.