N0n ransomware group lists NCT Kandla (container terminal operations) on its leak site

• Ransomware group: N0n
• Country: India
• Sector: Transportation
• Announcement date: October 12, 2026

The threat actor known as N0n has officially listed the Indian transportation organization NCT Kandla on its ransomware leak site. According to the announcement made on October 12, 2026, the group claims to have successfully breached the organization and is currently in possession of its data. This development follows a pattern of double extortion, a tactic where cybercriminals not only encrypt an organization's systems but also threaten to leak sensitive information to pressure the victim into paying a ransom.

The details of the N0n claim

The N0n group has stated that they are demanding a ransom payment of 1,600,000 USD from NCT Kandla. The group has indicated that if this financial settlement is not reached, they will proceed to publish the stolen information publicly. The threat actor specifically mentioned that the data intended for release includes operational correspondence and internal system logs. This method of extortion aims to maximize pressure by threatening the exposure of sensitive business communications and technical infrastructure details.

In modern ransomware campaigns, leak sites serve as a public gallery for attackers to showcase their victims. By listing a target on a dedicated site, the group attempts to damage the victim's reputation and create urgency. The specific threat to release internal logs is particularly concerning, as such data often contains technical insights into how a network is structured and how its users interact with various systems.

Data types involved in the breach

While the total volume and file count of the stolen data have not been disclosed, the N0n group has specified the nature of the information they claim to have acquired. The leaked content is said to include:

• Operational EDI (Electronic Data Interchange) correspondence
• Internal system logs

The inclusion of Electronic Data Interchange (EDI) information is significant in the context of logistics and transportation. EDI is a standardized method for the electronic exchange of business documents between different organizations. When such correspondence is compromised, it can expose the intricate details of how various entities in a supply chain communicate and conduct business transactions.

About NCT Kandla

NCT (Nandgaonkar Container Terminal) is a specialized container terminal operator located at the Kandla Port in India. The organization plays a critical role in the regional logistics landscape, providing essential services in port logistics, container handling, and terminal operations. Given its position in the transportation sector, the organization serves as a vital link in the movement of goods through the Kandla Port infrastructure.

Impact and security implications

This breach may pose significant risks to the operational continuity and commercial confidentiality of NCT Kandla. The exposure of EDI correspondence could lead to the disclosure of sensitive information regarding the organization's supply chain partners and logistics processes. Furthermore, the leaked system logs could provide a roadmap for further attacks against the organization's network infrastructure, as they may reveal vulnerabilities or internal configurations.

From a regulatory perspective, it is possible that the organization may face legal obligations under data protection regulations in India following such an incident. Organizations operating in the transportation and logistics sectors often deal with a high volume of third-party data, making them high-value targets for threat actors seeking to disrupt supply chains or extort large sums of money.

To defend against such threats, organizations in this sector typically focus on several defensive layers. This includes implementing robust access controls to protect sensitive EDI communications and ensuring that system logs are stored securely with strict access limitations. Regular auditing of network configurations and the implementation of multi-factor authentication are common industry standards used to mitigate the risk of unauthorized access. Regarding the threat actor, information regarding the N0n group is limited.