Camellia Line targeted by N0n ransomware group with claims of data breach

• Ransomware group: N0n
• Country: Japan
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group claims data breach at Camellia Line

The Japan-based shipping company Camellia Line has been listed on the N0n ransomware group's leak site. The threat actor group has issued a claim regarding a data breach involving the organization, marking a significant potential security incident for the transportation firm.

According to the announcement made on October 12, 2026, the threat actor known as N0n claims to have compromised data belonging to Camellia Line. The group has published this incident on their dedicated leak site to pressure the organization. The group has stated that if the ransom demand is not met, the stolen data will be released publicly on October 19, 2026. At this time, information regarding the specific identity or background of this group remains limited.

Details of the alleged exfiltration

The announcement made by the threat actor claims that specific sensitive records have been exfiltrated from the organization's systems. Based on the information provided by the group, the breach involves critical documentation related to the company's financial and logistics operations. Specifically, the claims suggest that the following types of data have been targeted:

• Freight payment records
• Financial settlement data

To support their claims, the group has provided screenshots as evidence of the breach. These samples include a file titled 'KFC freight check list' and various Excel files containing Japanese characters that appear to be related to the company's financial records. Such tactics are common in double extortion ransomware attacks, where threat actors not only encrypt an organization's systems but also steal sensitive data to use as leverage during ransom negotiations.

About Camellia Line

Camellia Line is a shipping company that provides ferry and Ro-Ro (roll-on/roll-off) transportation services. The company operates routes between Fukuoka, Japan, and Busan, South Korea, serving as a key link in the regional maritime transport network.

Risk assessment and industry implications

This claim may pose a significant risk to the organization's financial operations. The alleged exposure of freight and payment records could potentially compromise the company's business relations and sensitive customer data. Furthermore, the disclosure of such financial data could create opportunities for secondary phishing attacks targeting the organization's supply chain partners, as attackers often use stolen business information to craft highly convincing fraudulent communications.

From a regulatory perspective, such a breach may lead to legal sanctions and administrative fines under Japan's APPI (Act on the Protection of Personal Information). Organizations operating in the transportation and logistics sectors must remain vigilant against these types of threats. Common defensive steps for organizations facing such risks include implementing robust data loss prevention measures, maintaining strict access controls on financial databases, and conducting regular audits of third-party connections to mitigate the risk of supply chain exploitation.

Ransomware leak sites function as a platform for extortion, where groups post stolen data or notices of intent to leak data to increase pressure on the victim. As seen in this case, the threat of a public leak serves as a primary motivator for the ransom demand. For companies in the shipping industry, maintaining the integrity of freight and settlement data is essential for operational continuity and maintaining trust with international partners.