TTI Algeciras Data Breach

On October 12, 2026, the N0n ransomware group targeted TTI Algeciras, a significant port operator and logistics firm based in Spain. This listing occurred as part of a broader campaign by N0n against maritime logistics entities, placing TTI Algeciras among 71 other victims claimed over a sixty-day period. The Algeciras terminal is a critical hub for international trade, handling traffic between Europe, Africa, and the Americas, making it a potentially valuable target for cybercriminals. While SOCRadar’s queries of accessible stealer-log repositories did not return any direct records for TTI Algeciras, this absence of evidence does not confirm the absence of compromise. N0n’s recent activity reveals a broad targeting pattern across various sectors, including Transportation, Technology, and Healthcare, with a notable concentration of victims in the US, South Korea, and Brazil. The October 12 victim batch specifically included major global maritime infrastructure companies such as Ocean Network Express, CULines, T.S. Lines, and ZPMC. This diverse geographic and sectoral spread underscores N0n’s wide-ranging operational scope. The presence of TTI Algeciras in this cluster aligns with N0n’s pattern of targeting critical infrastructure within the global supply chain.

SOCRadar’s threat intelligence monitoring identified TTI Algeciras on the N0n ransomware group’s leak site on October 12, 2026. This listing coincided with a significant wave of claims against port operators and maritime logistics companies. N0n reported claiming 72 victims within the preceding sixty days, with a focus on the Transportation, Technology, and Healthcare industries, and a geographical prevalence in the US, South Korea, and Brazil. The specific listing of TTI Algeciras, a Spain-based terminal crucial to international trade routes, falls within this pattern. Queries conducted against accessible stealer-log repositories returned no matching records for TTI Algeciras’s operational domains. However, the absence of stealer-log records for TTI Algeciras does not rule out the possibility of a compromise or that N0n possessed valid access. Several other organizations listed by N0n in the same batch demonstrated significant credential exposure in the queried datasets. This suggests that the null result for TTI Algeciras may be due to limitations in the query coverage, the use of unindexed data, or the possibility that any compromised credentials were used and subsequently rotated before indexing. Private stealer-log markets and less common stealer families are not always captured in broad repository searches. Given the operational significance of TTI Algeciras as a major transshipment hub, the listing by N0n warrants immediate security action. Organizations in similar positions should consider a comprehensive credential audit, a thorough forensic review of VPN and remote-access logs around the time of the listing, and the implementation of phishing-resistant multi-factor authentication across all external-facing authentication endpoints to mitigate potential risks. Continued monitoring of dark web platforms and stealer-log feeds is also advised.