Santos Brasil listed on N0n ransomware leak site

• Ransomware group: N0n
• Country: Brazil
• Sector: Transportation
• Announcement date: October 12, 2026

N0n group claims attack on Santos Brasil

The threat actor known as N0n has listed the Brazilian logistics company Santos Brasil on its leak site. According to the announcement made on October 12, 2026, the group claims to have gained access to sensitive operational data belonging to the organization. This development follows a pattern often seen in modern cyberattacks, where threat actors utilize dedicated leak sites to pressure victims into paying ransoms by threatening to publish stolen information.

The incident involves a significant ransom demand. The N0n group has specified a payment of 26,000,000 USD to prevent the release of the allegedly stolen information. This type of extortion is characteristic of double extortion tactics, where attackers not only encrypt systems to disrupt operations but also steal data to use as leverage for further payment demands.

Details of the claimed data theft

The threat actor has issued a specific threat regarding the nature of the information they claim to possess. If the ransom demand is not met, the group has stated they will publish sensitive technical and operational files. The specific items mentioned in the announcement include:

• Terminal operating system database scripts
• Operational records

The disclosure of such technical assets, particularly database scripts, represents a significant risk to the target's digital environment. While the exact volume and file count of the stolen data have not been disclosed by the group, the focus on terminal operating systems suggests a direct hit on the core functions of the organization's infrastructure.

About Santos Brasil

Santos Brasil is a leading logistics company in Brazil that provides port terminal operations, logistics, and container transportation services. The company is particularly known for its terminal operations at the Port of Santos. Given its role in the transportation sector and its critical position within the Port of Santos, the company serves as a vital link in the regional and international supply chain.

Potential impact and industry implications

This incident may lead to disruptions in the operational continuity of Santos Brasil. The alleged theft of database scripts is particularly concerning, as these files could potentially be utilized for secondary attacks targeting the organization's logistics infrastructure. Such a scenario highlights the cascading risks inherent in modern supply chain logistics, where a breach in one node can impact broader operational stability.

Furthermore, the organization may face specific regulatory challenges. Under Brazil's LGPD regulations, the organization may face data breach notification obligations and potential legal scrutiny. The complexity of these legal requirements often necessitates a coordinated response between technical, legal, and communications teams.

Regarding the threat actor, information about the N0n group remains limited. However, the high ransom amount and the selection of a major logistics target may indicate that the group focuses on large-scale operations. In the broader context of cybersecurity, organizations in the transportation and logistics sectors often prioritize defensive measures such as network segmentation, robust access controls, and continuous monitoring to mitigate the risk of such high-impact breaches. As ransomware groups continue to target critical infrastructure and large-scale operations, the ability to maintain operational continuity amidst a data breach remains a primary concern for global logistics providers.