N0n ransomware group lists Portonave (container terminal operations) on its leak site

• Ransomware group: N0n
• Country: Brazil
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group targets Portonave

The Brazil-based port operator Portonave has been listed on the leak site of the ransomware group known as N0n. According to the announcement made on October 12, 2026, the threat actor claims to have successfully compromised data belonging to the organization. This incident follows a pattern seen in modern cyberattacks where threat actors use leak sites to pressure victims into paying ransoms by threatening to release sensitive information to the public.

The threat actor, N0n, has stated that it is demanding a ransom of 5,800,000 USD from the organization. The group has indicated that if this payment is not met, they will proceed to publish specific datasets. While the group has made these claims, public information regarding the specific identity and background of the N0n group remains limited.

Details of the alleged data breach

The threat actor claims that the compromised information includes critical operational data essential to terminal management. The group has threatened to release the following materials if their demands are not satisfied:

• Terminal operating system database
• Operational EDI archives

The threat actor has provided screenshots as evidence of the breach, which display sample files with .txt, .xlsx, and .pdf extensions. This type of exposure is a hallmark of double extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage during negotiations. In such scenarios, the goal is to create maximum pressure on the victim by threatening the loss of confidentiality and the potential disclosure of trade secrets or operational intelligence.

About Portonave

Portonave is a container terminal operator based in Navegantes, Brazil. The organization provides a variety of essential maritime and logistics services, including port operations, loading, unloading, and general logistics services. As a key player in the transportation sector, the company's operational continuity is vital to the regional supply chain.

Potential impact and industry implications

The alleged leak poses significant risks to the organization's operational continuity and the broader logistics chain. The exposure of terminal operating system data could lead to major disruptions in port operations and the potential disclosure of sensitive trade secrets. Furthermore, the leaked data could potentially be utilized by other actors in secondary attacks or as a means to facilitate supply chain compromises.

From a regulatory perspective, the organization may face administrative sanctions under Brazil's LGPD regulations due to its data protection obligations. Such incidents highlight the growing complexity of defending critical infrastructure against sophisticated ransomware groups. Even in cases where a ransom is paid, there is no guarantee that the stolen data will be permanently deleted by the threat actors.

For organizations operating in the transportation and logistics sectors, maintaining robust defensive postures is essential. This typically involves implementing multi-layered security controls, ensuring regular offline backups of critical databases, and maintaining strict monitoring of network traffic to detect unauthorized data exfiltration. Protecting the integrity of terminal operating systems and EDI archives is particularly crucial to preventing the types of operational disruptions threatened in this incident.