TTI Algeciras targeted by N0n ransomware group
The ransomware group N0n claims to have compromised data belonging to the Spain-based entity TTI Algeciras and has listed the organization on its leak site.
- Published
- 2 min read
- 2 min read
- Ransomware group: N0n
- Country: Spain
- Sector: Transportation
- Announcement date: October 12, 2026
N0n ransomware group claims data breach at TTI Algeciras
The ransomware group known as N0n has officially listed the Spanish organization TTI Algeciras on its leak site. According to the group's announcement, they claim to have successfully compromised the entity and obtained access to its operational data. This development marks a significant potential security incident for the transportation and logistics sector in Spain.
Details of the alleged attack
The N0n group published a leak announcement regarding TTI Algeciras, asserting that they have gained access to the organization's operational data. The group has issued a formal ultimatum, stating that if the ransom demand is not met, the stolen data will be released publicly on October 19, 2026. To facilitate the return of the data, the group is demanding a ransom payment of 10,000,000 USD.
This type of activity is characteristic of double extortion tactics often employed by modern ransomware groups. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to leak the data on a public forum, the attackers attempt to pressure the organization into paying the ransom to avoid reputational damage or regulatory scrutiny.
Scope of the alleged data leak
While the total volume of the stolen data has not been specified, the group has provided details regarding the types of information they claim to have exfiltrated. Based on the information provided in the leak announcement, the following data types are allegedly involved:
- Operational EDI message archives
- Internal terminal systems documentation
The group has reportedly provided screenshots as evidence of the breach, which include sample files with '.EDI' and '.docx' extensions, suggesting that both structured communication data and standard office documents are part of the alleged theft.
About TTI Algeciras
TTI Algeciras is a container terminal operator located at the port of Algeciras, Spain. The company provides essential port operations, including loading, unloading, and container handling services. Given its role in the maritime logistics chain, the organization plays a vital part in regional and international trade operations.
Risk assessment and industry implications
This alleged data breach may pose significant risks to TTI Algeciras's operational continuity and its trade secrets. Because the organization operates within Spain, it is subject to the strict data security obligations mandated under the European Union's General Data Protection Regulation (GDPR). The nature of the leaked data, particularly operational messages and internal documentation, could potentially lead to secondary attacks targeting the organization's logistics processes or create broader supply chain risks.
Public information regarding the N0n group remains limited; however, the high ransom demand of 10 million USD may suggest that the group specifically focuses on high-value corporate targets rather than smaller individual entities. For organizations operating in the transportation and logistics sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Defensive measures typically include implementing strict access controls, maintaining offline backups, and conducting regular audits of EDI communication channels to prevent unauthorized access to operational archives.