ZPMC Data Breach

N0n has targeted ZPMC, a prominent global manufacturer of port cranes and terminal engineering systems. The threat actor listed ZPMC on its dark web leak site on October 12, 2026, as part of an ongoing campaign. This incident marks ZPMC as one of 72 victims claimed by N0n over a 60-day period. The analysis revealed eleven employee credentials exposed through stealer-log monitoring, classifying ZPMC as a higher-exposure target within the batch of victims listed on October 12. ZPMC’s critical role in global port infrastructure, supplying essential equipment and engineering services to numerous countries, makes it a significant target. A compromise within ZPMC could have downstream implications for port operators that depend on its systems and support. N0n’s recent campaign, spanning the last 60 days, has primarily focused on the Transportation, Technology, and Healthcare sectors. The United States, South Korea, and Brazil have emerged as countries with the highest number of claimed victims during this period. Other organizations affected by N0n within the same timeframe include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), and T.S. Lines (Taiwan, Transportation). While ZPMC operates in the Manufacturing sector, its inclusion among these transportation-focused victims highlights N0n’s expanding target scope beyond direct shipping companies, potentially leveraging ZPMC’s position as a key supplier to the logistics industry.

SOCRadar’s investigation identified eleven employee credentials associated with ZPMC’s systems and third-party platforms. This mixed profile suggests that access may have been gained across multiple compromised endpoints, potentially indicating a broader compromise rather than a single point of entry. ZPMC’s role as a global supplier of port cranes and terminal engineering systems is a critical factor. Compromised access to ZPMC’s engineering, project management, or client-portal systems could extend beyond its internal network, posing a downstream risk to international port operators that rely on ZPMC’s infrastructure and ongoing technical support. The exposure of credentials underscores the potential for further intrusion activities. The observed credential exposure does not definitively confirm a successful ransomware deployment or data exfiltration by N0n. However, infostealer-harvested credentials can serve as a valuable entry vector for ransomware operations, enabling threat actors to gain initial access, validate accounts, and potentially move laterally within a victim’s network. The mixed profile of compromised credentials, affecting both ZPMC’s internal systems and external platforms, necessitates a thorough review of security measures. This includes examining access logs for VPNs, Microsoft 365, and project management platforms during the period when these credentials may have been compromised. Rotate all credentials across engineering and client-facing systems. Audit VPN, M365, and project management platform access logs during the credential collection window. Consider notifying downstream port operator clients of a potential supplier-side exposure.