GlobalNet LCL listed on N0n ransomware leak site

• Ransomware group: N0n
• Country: Indonesia
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group claims attack on GlobalNet LCL

The threat actor known as N0n has listed the Indonesian logistics firm GlobalNet LCL on its ransomware leak site. According to the announcement made on October 12, 2026, the group claims to have successfully compromised sensitive data belonging to the organization. The threat actor has issued a ransom notice, asserting that the data will be released to the public if their demands are not met.

The group has demanded a payment of 800,000 USD to prevent the disclosure of the stolen information. While the group has published a ransom notice and a screenshot as proof of the breach, public information regarding the specific capabilities or identity of the N0n group remains limited. This incident highlights the ongoing threat posed by ransomware groups that utilize leak sites to exert pressure on their victims through public exposure threats.

Details of the claimed data breach

The notice provided by the N0n group specifies that the compromised information is directly related to the operational activities of the victim. Specifically, the threat actor claims that the breach involves critical logistics and operational documentation. According to the claims, the following types of data have been compromised:

• Container gate movement records
• Damage management records

The group provided screenshots as evidence of the breach. The file names visible in these screenshots appear to correspond to documents used in logistics operations, supporting the claim that the stolen data is tied to the company's core business functions. The presence of such operational data in the hands of a threat actor poses significant risks to the integrity of the organization's business processes.

About GlobalNet LCL

GlobalNet LCL is an Indonesia-based port agency and logistics service provider. The company operates within the transportation sector, specifically focusing on port operations. Their professional scope includes handling critical logistics tasks, such as managing container gate movements and maintaining records related to damage management.

Risk assessment and industry implications

The alleged leak indicates that GlobalNet LCL's operational data and logistics processes may be at risk of exposure. Such a breach can have far-reaching consequences for an organization operating in the supply chain. The potential release of this data could damage the organization's commercial confidentiality and lead to a loss of trust among supply chain partners. Furthermore, the organization may face legal obligations under Indonesian data protection regulations following such an incident.

This incident appears to be an example of double extortion, a tactic where threat actors not only encrypt an organization's data but also threaten to leak it to increase the pressure to pay. By threatening to release sensitive operational records, the attackers aim to maximize their leverage. There is also a significant risk that the leaked data could be utilized in secondary attacks or targeted phishing campaigns against the company or its partners.

For organizations in the transportation and logistics sector, maintaining robust cybersecurity posture is essential to protect against such threats. Common defensive strategies include implementing strict access controls, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities. Protecting the confidentiality of operational data is vital for maintaining the trust of partners and ensuring compliance with regional data protection laws.