T.S. Lines Data Breach

N0n listed T.S. Lines on its leak site on October 12, 2026. The Taiwan-based container shipping operator is one of 72 victims the group claimed in the preceding sixty days, and it drew the joint-highest employee credential count in N0n’s October maritime batch. No public statement from T.S. Lines had been issued at time of publication. N0n’s sixty-day campaign focused on Transportation, Technology, and Healthcare, with the strongest geographic concentration in the US, South Korea, and Brazil. Other maritime and logistics organizations named in the same period include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), and ZPMC (China, Manufacturing).

Stealer-log queries for tslines[.]com returned twenty-five employee credentials against corporate identity and shipping management systems — the joint-highest employee credential count in N0n’s October 2026 maritime batch. That volume points to broad workstation compromise across multiple endpoints, consistent with a pre-deployment reconnaissance phase. For an intra-Asia carrier, the exposed credentials reach vessel management systems, booking and cargo documentation platforms, and maritime authority portals — all meaningful lateral movement targets. Infostealer malware has become a standard initial-access mechanism for ransomware operators: credentials harvested from infected workstations and sold on dark web markets compress the time from initial access to deployment. T.S. Lines and peer organizations should run immediate stealer-log sweeps for tslines[.]com and related domains, enforce phishing-resistant MFA on VPN gateways and SSO systems, and review remote-access logs for the window preceding October 12.