N0n ransomware group lists BKH ICD (inland container depot operations) on its leak site
The threat group N0n claims to have compromised data belonging to the South Korean entity BKH ICD and has issued a ransom demand.
- Published
- 3 min read
- 3 min read
- Ransomware group: N0n
- Country: South Korea
- Sector: Transportation
- Announcement date: October 12, 2026
N0n ransomware group claims attack on BKH ICD
The threat actor known as N0n has officially listed the South Korean organization BKH ICD on its dedicated leak site. According to the announcement made on October 12, 2026, the group claims to have successfully compromised the organization's networks. This incident follows a common pattern in modern cyberattacks where threat actors utilize double extortion tactics, a method where they not only encrypt an organization's systems but also steal sensitive data to use as leverage for ransom demands.
In this specific case, the N0n group is alleging that they have gained unauthorized access to the internal networks of BKH ICD. To support their claims of a successful breach, the group has provided specific samples of the data they assert to be in their possession. The group has issued a ransom demand of 1,200,000 USD. Furthermore, the threat actors have issued a deadline, stating that if the requested payment is not fulfilled, the stolen data will be published on the group's leak site on October 19, 2026.
Details of the claimed data theft
The N0n group has provided specific details regarding the types of information they claim to have exfiltrated from the BKH ICD networks. Based on the announcement, the stolen information is centered around commercial and technical documentation. The group has provided specific file samples to serve as proof of the theft, including a PDF file titled 'Release Note_PKT_20250327.pdf' and an Excel spreadsheet named 'Invoice Details Listing (Sample).xlsx'.
The specific categories of data identified in the threat actor's announcement include:
- Commercial invoice records
- System release documentation
The possession of such documents by a threat actor presents a significant risk to the target organization. Commercial invoices often contain sensitive pricing, client information, and transaction details, while system release documentation can provide a roadmap of the organization's internal technical environment.
About BKH ICD
BKH ICD is an inland container depot operator located in South Korea. The company plays a role in the regional logistics infrastructure by providing essential container storage, handling, and various logistics support services. As a provider of these services, the organization is integrated into the broader supply chain, making the security of its data and operational continuity vital to its business partners.
Impact and risk assessment
This incident highlights the significant risks faced by organizations when sensitive commercial data is exposed. The potential leakage of invoice details can have cascading negative impacts on an organization's business partners and its overall supply chain integrity. Furthermore, the exposure of technical documentation, such as system release notes, may allow competitors or other malicious threat actors to analyze the organization's operational processes and system architecture more effectively.
From a regulatory perspective, the organization may be required to fulfill specific data breach notification obligations under South Korean regulations. Such requirements are designed to ensure transparency and allow affected parties to take necessary precautions.
While information regarding the N0n group remains limited, this incident underscores the importance of robust cybersecurity frameworks. Organizations in the transportation and logistics sectors can mitigate such risks by implementing strong network segmentation, maintaining rigorous access controls, and ensuring comprehensive logging and monitoring. Additionally, regular audits of system documentation and strict data handling policies can help reduce the impact of a potential breach. Defensive strategies should focus on protecting the integrity of the supply chain and ensuring that sensitive commercial and technical information remains confidential.