Tsuneishi / Kambara Kisen Data Breach

N0n has claimed Tsuneishi / Kambara Kisen, a Japanese entity involved in shipbuilding and ship management, as a victim, listing them on its dark web leak site on October 12, 2026. Analysis of stealer logs targeting the domain tsuneishi[.]com revealed six employee credentials with a freshness spanning from August to October 2026, coinciding with the leak date and suggesting ongoing data exposure. This incident highlights the persistent threat of ransomware groups targeting critical infrastructure and logistics sectors, especially companies operating in regions with significant trade and manufacturing capabilities. Over the preceding 60 days, N0n has claimed a total of 72 victims, with a pronounced focus on the Transportation, Technology, and Healthcare industries. The group’s operational footprint is geographically concentrated in the United States, South Korea, and Brazil. Alongside Tsuneishi / Kambara Kisen, other notable victims within this period include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). The inclusion of Tsuneishi / Kambara Kisen, a manufacturing entity, aligns with N0n’s established targeting patterns in the sector.

The SOCRadar threat intelligence platform monitored N0n’s dark web leak site and observed the listing of Tsuneishi / Kambara Kisen on October 12, 2026. A stealer-log analysis conducted against the domain tsuneishi[.]com identified six employee credentials. The freshness of these credentials ranged from August to October 2026, directly correlating with the date of the listing and indicating a potential ongoing compromise. The identified credentials encompassed a range of access points within Tsuneishi / Kambara Kisen’s infrastructure. Specifically, four credentials targeted the organization’s Microsoft 365 tenant, suggesting a direct compromise of identity and single sign-on capabilities. The remaining credentials were for an internal application portal, a development environment, and a campus WiFi access point. The presence of a corporate email credential on a third-party consumer platform further broadens the potential attack surface. The diversity of systems accessed via these credentials, originating from what appears to be a single compromised endpoint, points to a significant network presence within the group’s infrastructure. This wide reach increases the potential for lateral movement and further data exfiltration or system encryption. Given the August–October freshness window of the compromised credentials, any account that has not been updated since August should be considered potentially compromised. Recommended Response: Force-rotate all Microsoft 365 accounts immediately. Treat the credential found for the development environment as a potential vector for source code or intellectual property exposure and initiate a thorough investigation. Review all sessions tied to the corporate email credential on third-party consumer platforms. Given the observed freshness of credentials, conduct an immediate review of all accounts and systems, treating any credential not rotated since August 2026 as compromised.