Teamxxx ransomware group lists narvikhavn.no on its leak site
The threat actor group known as Teamxxx has published data allegedly belonging to narvikhavn.no on its leak site.
- Published
- 2 min read
- 2 min read
- Ransomware group: Teamxxx
- Country: Norway
- Sector: Transportation
- Announcement date: June 10, 2025
Teamxxx claims data breach against Narvik Havn
The threat actor group known as Teamxxx has published data allegedly belonging to narvikhavn.no on its leak site. According to the announcement made on June 10, 2025, the group claims to have targeted the domain of the Norwegian port authority. This development follows a period of alleged unauthorized access that the group claims occurred in March 2025.
Details of the alleged incident
The Teamxxx group has created a leak announcement claiming to have targeted the narvikhavn.no domain. The announcement lists various file archives and database backups that are alleged to belong to the organization. These files are presented as the result of a security incident that the group claims took place on March 3, 2025.
Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. By publishing data on a dedicated leak site, the threat actors aim to damage the victim's reputation and force a ransom payment to prevent further exposure. While the group has made these claims, the incident remains an allegation from the threat actor side.
Data and files involved in the claim
The leak announcement includes specific references to file archives and database backups that the group claims to have obtained. Based on the information provided in the announcement, the following data types are listed as being affected:
- Database backups
- File archives
The group has provided evidence in the form of screenshots showing specific file names. These files include 'dbs.zip', 'files.zip', and 'hbm2_20250217.sql.gz'. These specific archives may contain various file contents and database records belonging to the organization.
About Narvik Havn
Narvik Havn is a port authority located in Narvik, Norway. The organization is responsible for managing maritime transport, logistics services, and port infrastructure in the region.
Risk assessment and implications
This leak claim may bring the risk of exposure for sensitive data within narvikhavn.no. In addition to operational data, it is possible that employee or customer information may have been compromised. As the organization operates in Norway, the incident may be subject to GDPR (General Data Protection Regulation) and could trigger relevant legal processes. Furthermore, the leaked data could serve as a source for secondary attacks, identity theft, or targeted phishing campaigns.
For organizations operating in the transportation and logistics sector, such incidents highlight the importance of robust cybersecurity frameworks. Protecting critical infrastructure requires comprehensive defensive measures, such as maintaining offline backups, implementing strict access controls, and conducting regular security audits. When a breach is suspected, organizations typically move to contain the threat, assess the scope of the data compromise, and fulfill legal notification requirements to regulatory bodies and affected parties.
Public information regarding the Teamxxx group remains limited. At this time, there is little available in the public domain to characterize the full scope or specific motivations of this particular threat actor group beyond this specific claim.