N0n ransomware group lists T2S (terminal systems operations) on its leak site

• Ransomware group: N0n
• Country: Brazil
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group targets T2S

The N0n ransomware group has listed the Brazilian-based company T2S (terminal systems operations) on its dedicated leak site. According to the announcement made on October 12, 2026, the threat actors claim to have successfully exfiltrated internal data belonging to the organization. This development marks a significant escalation in the group's activity, targeting a key player in the transportation sector.

The threat actor has reportedly issued a ransom demand of 2,400,000 USD to the organization. The group has established a deadline for the settlement, stating that if the ransom is not paid, the alleged stolen data will be published on the leak site on October 19, 2026. This tactic is a hallmark of modern cyber extortion, where attackers use the threat of public exposure to pressure victims into payment.

Details of the alleged data theft

While the specific volume of the stolen data has not been disclosed, the N0n group has provided sample files to substantiate their claims. These samples include a PDF report, an Excel spreadsheet, and an SQL text file. The contents of the stolen information are said to be highly sensitive to the organization's operations.

The announcement claims that the following types of data are involved in the breach:

• Terminal systems gap-analysis documentation
• Internal database material

The inclusion of SQL files and database materials suggests that the attackers may have gained access to structured data repositories, which often contain critical operational and potentially personal information.

About T2S (terminal systems operations)

T2S is a company based in Brazil that specializes in port terminal operations and terminal systems. The organization provides a wide range of services including port logistics, terminal systems gap analysis, and operational support. Given its role in port logistics and terminal systems, the company plays a vital part in the regional transportation infrastructure.

Analysis and potential impact

This incident indicates that T2S may be facing a significant risk of exposure regarding its operational data and system architecture. The alleged database and system analysis files could potentially serve as a roadmap for secondary attacks against the organization's infrastructure. When attackers obtain detailed gap-analysis documentation, they gain insight into the vulnerabilities and architectural weaknesses of a target's network.

The group's approach, characterized by a high ransom demand and a strict deadline, suggests that N0n employs double-extortion tactics. In a double-extortion scenario, attackers do not just encrypt a victim's systems to disrupt operations; they also steal sensitive data to threaten the victim with its public release. This increases the pressure on the organization, as the threat of a data leak can lead to severe reputational damage and legal consequences.

Under Brazil's LGPD (General Data Protection Law), such a data breach may lead to legal and administrative sanctions for the company. Furthermore, the organization's supply chain partners and terminal operations may be at risk of targeted phishing or unauthorized access attempts resulting from this leak. When operational details are exposed, it often leads to a ripple effect where partners and clients become targets for secondary attacks.

To defend against such threats, organizations in the transportation and logistics sector should consider implementing robust security measures. These include maintaining offline backups, implementing multi-factor authentication (MFA) across all systems, and conducting regular vulnerability assessments. Additionally, monitoring for unauthorized data exfiltration and establishing a clear incident response plan are essential steps for mitigating the impact of ransomware and data breach events.