Superterminais listed on N0n ransomware leak site

• Ransomware group: N0n
• Country: Brazil
• Sector: Transportation
• Announcement date: October 12, 2026

The threat actor group known as N0n has officially listed the Brazilian organization Superterminais on its dedicated leak site. According to the announcement made on October 12, 2026, the group claims to have successfully conducted a ransomware attack against the entity and asserts that they are in possession of the company's data.

The ransomware claim and ransom demand

The N0n group has publicly claimed responsibility for a ransomware attack targeting Superterminais. As part of their extortion attempt, the threat actors have stated that they are demanding a ransom payment of 1,600,000 USD from the organization. The group has set a deadline for the release of the alleged stolen information, announcing that the data would be published on the leak site on October 19, 2026.

This incident follows a common pattern seen in modern cyber extortion known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The attackers then use the threat of leaking this information on public forums or specialized leak sites to pressure the victim into paying the ransom. This method increases the pressure on the target, as the loss of data privacy can be just as damaging as the loss of operational capability.

Alleged data and contents of the leak

While the total size and specific file count of the stolen data have not been disclosed by the group, the announcement specifies the types of information that have allegedly been compromised. To support their claims, the threat actors have shared certain file names as proof of the breach. The leaked content is said to include:

• Operational EDI archives
• Interface operational records

The presence of Electronic Data Interchange (EDI) archives is particularly significant in industrial and logistics environments, as these files often facilitate the automated exchange of business documents between different organizations. The compromise of such data can lead to various downstream operational and security challenges.

About Superterminais

Superterminais is a port terminal operator based in Manaus, Brazil. The company specializes in logistics operations, container handling, and port services within the Amazon region.

Impact assessment and organizational risks

This incident may pose significant risks to the operational continuity and data privacy of Superterminais. If the leaked data contains sensitive information regarding logistics processes, negative impacts on the organization's supply chain may be observed. Furthermore, the organization may face legal sanctions under Brazil's LGPD regulations due to the potential exposure of sensitive information.

Beyond the immediate disruption, the stolen data could be utilized by the threat actors for secondary attacks or targeted phishing campaigns against the organization or its partners. In the transportation and logistics sector, where interconnectedness is vital, such breaches can have a ripple effect across the supply chain.

To mitigate such risks, organizations in this sector typically focus on several defensive strategies. Implementing robust network segmentation can help contain an attack and prevent lateral movement by threat actors. Regular, offline backups are essential for recovering from encryption-based attacks. Additionally, monitoring for unauthorized data exfiltration and implementing strict access controls for sensitive operational archives, such as EDI files, are critical components of a modern cybersecurity posture. Information regarding the specific capabilities and background of the N0n group remains limited at this time.