Logistics, Ports, Airports and Transport, Oct 2026

Incidents

n0n campaign against the maritime and logistics chain

The campaign attributed to n0n was the most significant event of the period for the sector. On October 12, 2026, the group added 38 shipping, port, and logistics organizations in a single batch to its leak site. Separate coverage expanded or reframed the scope to more than 40 entities when counting port authorities, vessel managers, shipping companies, and technology providers. The mix of targets points to a campaign designed to maximize reputational damage and negotiation pressure, rather than an opportunistic attack on a single actor. In other words, the value of the incident for the attackers lies not only in initial access, but also in the ability to turn a possible technical compromise into a sector-wide trust crisis.

Well-known names for the region appeared in the batch, including Santos Brasil, Portonave, and Superterminais. Ransomware.live also listed T2S as a presumed victim linked to terminal systems operations in Brazil. Those entries mention alleged database scripts, EDI files, operational logs, and internal terminal material, but they do not independently confirm real access. For an operational reader, the key point is that the attackers are targeting material that, if authentic, could affect operational integrity, document exchange, and cargo visibility. However, the public material does not allow us to determine which part of that information was actually stolen, which part was exaggerated, and which part was listed only to apply pressure.

Timing also matters. Several reports cited a payment or publication deadline for October 19, 2026. That fits the classic extortion pattern: the group sets a short pressure window to force a response before internal incident response, legal counsel, or the insurer can settle on a position. In n0n's case, that pressure was reinforced by the sector-wide scope of the list and by the possibility that access was not direct, but came through a shared provider. If that hypothesis is correct, the impact of the campaign would be measured not only by one compromised company, but by a third party's ability to expose multiple clients at once.

Several sources pointed to the possibility of a supply chain tied to CyberLogitec or another maritime technology provider, but none presented that as a proven fact. Even so, from a defensive standpoint, the hypothesis is plausible enough to justify immediate controls: review third-party access, rotate shared credentials, segment environments, validate EDI interface integrity, and strictly control remote sessions. The risk in this kind of campaign is not just the initial intrusion, but administrative lateral spread. A support credential, a shared console, or a persistent VPN tunnel can turn a point incident into systemic exposure.

As for the impact, the available material does not confirm operational disruption or encryption in the named organizations. That does not make the episode any less serious. In the maritime ecosystem, even an unverified claim can generate response costs, contractual pressure, and forensic work to prove the absence of compromise or define the scope. In addition, if the actors publish credible fragments of internal documents, the reputational damage can be enough to affect relationships with customers, agents, and authorities. For that reason, the reading for CISOs in the sector should not focus only on "was there ransomware?", but on "what exposure allowed the attacker to make the threat credible?"

Brazil: Santos Brasil, Portonave, Superterminais, and T2S

Brazil was the most visible Latin American country in n0n's maritime batch. The sources agree that Santos Brasil, Portonave, and Superterminais appeared, and some records added T2S as an organization linked to terminal systems. In several cases, the entries mention databases from terminal operating systems, operational EDI files, interface logs, and internal breach analysis documentation. The described content is consistent with a campaign aimed at extracting or simulating the extraction of highly sensitive operational material, documentation that could facilitate fraud, secondary extortion, or social engineering against port staff and their partners.

The most important point, however, is methodological caution. None of the named organizations publicly confirmed an intrusion in the material reviewed for this report. Ransomware.live entries and specialized media reports are useful warning signs, but they do not replace technical or institutional confirmation. For a Brazilian CISO in the sector, that means two simultaneous lines of action: internal verification to determine whether there is a real compromise, and reputational containment to answer questions from customers, customs authorities, insurers, and the media without oversharing sensitive information.

From an operational perspective, Brazil occupies a critical position because it combines high volumes of foreign trade, a diverse private operator base, and complex technology integration ecosystems. Terminals, port operators, and support systems often rely on integrations with shipping lines, customs brokers, maritime agencies, and data exchange platforms. That network of dependencies makes any threat involving data access, support credentials, or EDI files especially sensitive. If the materials described by the attackers were authentic, the risk would not be limited to confidentiality loss. It would also include process manipulation, document release delays, and a larger attack surface for cargo fraud.

There is also a geopolitical and supply chain angle. The recurrence of Brazilian companies in the list may indicate that the regional market is being watched not as a set of isolated targets, but as a high-value node within an international chain. The presence of terminal and port operators in the same batch suggests that extortion may be aimed at a shared ecosystem of tools, support, and remote access. That forces Brazilian CISOs to think beyond the local perimeter. Third-party controls, privileged identity management, and support session traceability are, in this context, as important as OT network segmentation.

Ecuador: Transportes Jiménez and Reyes Jim Rey S.A.

In Ecuador, the visible case during the period was Transportes Jiménez and Reyes Jim Rey S.A., a ground freight transport company attributed by Ransomware.live and DeXpose to the Emperador group. Here the source provides a concrete figure: an estimated exfiltration of 501 MB, with financial, accounting, and banking documents among the materials allegedly stolen. If authentic, that kind of content points to an extortion incident with a strong financial and privacy component, since it combines operational data with records that can facilitate fraud, commercial identity theft, or pressure on management.

Unlike n0n's maritime campaign, this case suggests a more limited exfiltration and a direct claim by the Emperador group. DeXpose also indicated that the attackers threatened to publish customer and employee information if no resolution was reached. However, the coverage did not present confirmation from the company or independent evidence of access. Therefore, the solid point is not the intrusion itself, but the existence of an extortion claim with a declared data volume and a pressure narrative aimed at forcing negotiations.

For the ground transport sector, this type of incident has specific implications. Unlike a port or terminal, where continuity depends on industrial and yard management systems, ground freight transport relies on a delicate balance among documentation, traceability, dispatch, and customer coordination. A leak of financial or banking documents can affect liquidity, supplier relations, and billing capacity. In addition, exposure of customer and employee information can create legal and fraud risk. In medium-sized or family-owned companies, the temptation to negotiate quickly is often high, which makes predefined procedures for digital extortion even more important.

Paraguay: Tape Ruvicha and the Qilin claim

In Paraguay, DeXpose reported that Qilin claimed an attack against Tape Ruvicha and threatened to publish data if negotiations did not begin. The material reviewed does not provide confirmation from the company itself, from a Paraguayan official body, or from independent technical evidence. That means that, from the strict perspective of this report, the case should be understood as a claim from the malicious actor or a monitoring source, not as a verified compromise. Even so, it is useful to include because it shows that pressure on the region is not limited to transport and logistics. The actors continue to target companies in sectors tied to supply chains, distribution, and economic support.

For Paraguay, the lesson is preventive. When a local company appears on a leak site or in an extortion post, the challenge is not only forensic. It is also about communication and continuity. Management needs to know what to say to partners, how to preserve evidence, how to decide whether notification is required, and how to measure third-party exposure. Even if the case is not confirmed, the fact that the actor chose that name can already trigger external inquiries. For that reason, early coordination among cybersecurity, legal, communications, and business continuity teams is essential.

Regional reading for the month

The geographic spread of the period's cases is as important as their content. Brazil stands out in n0n's maritime campaign. Ecuador records an extortion claim with 501 MB allegedly exfiltrated. Paraguay adds a claim attributed to Qilin. The pattern suggests that attackers are not operating by country, but by network value and monetization potential. In other words, the risk map is being defined more by a company's centrality in its supply chain than by geography itself.

That has direct consequences for CISOs in transport, ports, and logistics. Protection cannot be based only on hardening the primary asset. It must extend to the network of partners that makes daily operations possible. In the sector, third-party remote access, EDI exchanges, and exposure of support systems are as critical as email or the corporate VPN. If the adversary manages to access a provider that administers shared systems, the real victim may be a list of companies, not a single organization.

Countries

Brazil

Brazil had the highest visibility in the period across the maritime and logistics chain. The appearance of Santos Brasil, Portonave, Superterminais, and T2S in the same claim universe is significant because it points to exposure affecting container terminals, port operators, and terminal systems alike. At the sector level, Brazil stands out as a large, highly integrated market with multiple cross-dependencies among private operators, shipping lines, technology vendors, and service partners. That complexity amplifies the impact of any extortion incident, even if the compromise has not been publicly confirmed.

The most relevant defensive angle is the possible exposure of EDI files and operational material. In a port context, those documents are not ancillary, they support cargo flow, document validation, and coordination among stakeholders. If a group threatens to publish material of that kind, the potential damage is not only reputational. It can also include commercial pressure, contract reviews, mistrust in process integrity, and more regulatory scrutiny. For that reason, in Brazil the focus should be on third-party access hygiene, credential segmentation, and anomaly monitoring in support and terminal systems.

One nuance is worth underscoring, the number of names does not necessarily imply multiple independent intrusions. It is possible that several entities were pulled in through the same access path, or that the group reused partial information to build a broader narrative. From a response standpoint, that calls for an investigation centered on shared patterns, providers, software versions, persistent remote access, reused credentials, and OT dependencies. If a Brazilian operator detects a compromise, the right question is not only, "what did they take?" but also, "which other clients or partners share the same attack surface?"

Ecuador

Ecuador saw the visible case of Transportes Jiménez y Reyes Jim Rey S.A., a land cargo transport company that, according to the sources, was claimed by Emperador. The mention of 501 MB of data and the presence of financial, accounting, and banking documents increase the interest in the case, because they suggest an extortion pattern in which the most valuable asset is not the availability of a dispatch system, but the confidentiality of sensitive economic information. If the data is real, the impact could extend to fraud, commercial blackmail, and contract disputes.

The lesson for Ecuador is that cyberextortion against ground transport does not necessarily depend on major infrastructure or complex technology. A cargo company can be valuable to an attacker because it concentrates documents, routes, customer data, billing, and evidence of operations. For that reason, defense should include verified backups, segmented administrative access, stronger protection for document directories, and response procedures that do not rely on the immediate availability of internal systems. In this type of company, resilience is often as important as prevention.

Paraguay

Paraguay appears in the period through Qilin's claim against Tape Ruvicha. Although the material offers no independent confirmation, the case remains useful for understanding the pressure extortion groups place on mid-sized and large companies in the region. The absence of public confirmation does not eliminate reputational risk, the simple fact of being named in an adversary's publication can force a company to review its controls, its legal position, and its external messaging.

For the Paraguayan market, the message is clear, the response to extortion cannot be improvised. There must be a prior process to assess evidence, decide whether to notify, preserve artifacts, and coordinate spokespersons. In addition, companies with cross-border relationships must assume that a visible claim on the internet can quickly cross contractual borders. Discipline in incident management and early communication with clients and partners are as important as technical hygiene.

Mexico

Mexico did not concentrate a specific October incident equivalent to the Brazilian or Ecuadorian cases in this report, but it does appear in the regional context figures. A ransomware roundup said the country recorded 60 critical infrastructure organizations as victims between January 1, 2025 and September 21, 2026. That figure does not refer exclusively to October, but it reinforces a well-known reality, Mexico remains among the Latin American countries with the highest exposure in sensitive sectors.

For transport and logistics, the reading is that the country remains a high-value target because of market size, cross-border volume, and the diversity of operators. Without assigning October incidents specifically to Mexico, the comparative data suggests an environment in which sector preparedness must be sustained. For Mexican CISOs, that means prioritizing visibility into legacy environments, third-party inventories, remote access hardening, and extortion response exercises that bring together legal, continuity, and operations teams.

Chile and the rest of Latin America

Diario Financiero reported, based on Entel Digital, that transport and logistics accounted for 27.8% of ransomware attacks recorded in Latin America between January 2025 and September 2026. That figure should not be read as an October-only snapshot, but it is a structural signal of the sector's weight in the region. The explanation fits business dynamics, tight margins, 24/7 operations, heavy dependence on third parties, and little tolerance for disruption.

The regional comparison also helps explain why n0n-style extortion campaigns gain traction. When a group manages to publish a broad batch of transport, port, and logistics companies, it knows it is hitting a sector that places enormous value on compliance reputation and uninterrupted flow. Even without encrypting systems, the threat of exposure can be enough to trigger negotiations or media pressure. For that reason, sector defense in Latin America should stop treating extortion as an isolated event and start treating it as a recurring operational risk.

Regional trends and implications

The first trend in this period is the consolidation of batch extortion. Instead of hitting one company and then moving to the next, groups are publishing dozens of names at once, combining psychological pressure, media noise, and alleged documentary evidence. This strategy works especially well in sectors where business relationships are interdependent and where customer and regulator trust matters as much as system availability. In logistics and transportation, publishing names can cause damage even when the intrusion has not been confirmed, because operations depend on credibility, permits, documents, and timing.

The second trend is the centrality of the vendor. Although this report does not confirm a supply chain intrusion technically, several reports suggest that n0n's maritime batch may have been linked to a maritime technology provider or shared IT services. That hypothesis, whether accurate or not, reflects a reality CISOs can no longer ignore, the attack surface is increasingly organized around critical vendors, not just the corporate perimeter. In ports, terminals, and logistics companies, support access, remote links, and EDI systems are just as sensitive as an internal domain.

The third trend is the mix of extortion and document exposure. Attackers appear to be betting that a set of plausible files, scripts, logs, databases, EDI, and accounting documents will carry enough value to force payment or, at minimum, amplify the threat. The problem for victims is that technical verification takes time, while media pressure is immediate. That is why a predefined crisis plan matters, one that includes evidence preservation, scope analysis, external messaging, and clear criteria for whether to negotiate.

The fourth regional implication is regulatory. Although the U.S. Coast Guard's NVIC 02-26 is not a Latin American rule, it sets a global benchmark for maritime and port operators that work with international supply chains. The requirement to designate a cybersecurity lead, conduct assessments, and submit formal plans points to where regulatory expectations are heading, less improvisation and more demonstrable governance. For companies in the region that operate with international partners, this is not a cosmetic compliance issue, it is a requirement for market access and business continuity.

The fifth implication is the persistence of actively exploited vulnerabilities in orchestration and management platforms. The CVE-2026-114625 case in Arista VeloCloud Orchestrator on-premises matters because it affects the core of distributed connectivity. For logistics networks with multiple branches, warehouses, terminals, or exchange points, centralized management is often essential. If that system falls into the wrong hands, the impact can escalate quickly. Its inclusion in KEV and confirmation of active exploitation should push teams to review not only the patch, but the full inventory of orchestrators, appliances, and exposed remote services.

Recommendations for CISOs

1. Map critical vendors by access, not just by contract. In ports, terminals, and transportation, the relevant vendor is not only the one billing for software. It is the one with remote access, shared credentials, persistent support, or operational visibility. That map should show who has access, from where, with what MFA, at what time, and with what traceability.

2. Review and restrict third-party remote access. The n0n campaign again shows why support access is a concentration point for risk. Any persistent or permanent connection that is not essential should be removed. Temporary access should expire, be logged, and be audited.

3. Require MFA and rotation of shared credentials. If a terminal or logistics environment still depends on shared credentials for support, the risk is structural. Periodic rotation, removal of generic accounts, and multifactor authentication should be mandatory, not optional.

4. Separate operational, administrative, and document-exchange environments. EDI systems, customer portals, support tools, and operations consoles should not share privileges or unnecessary access paths. Segmentation reduces the value of a stolen credential.

5. Prepare a response specifically for extortion without verified encryption. Many crises in the sector do not begin with a ransomware deployment, but with a threat to publish. The organization must know how to respond when the only confirmed fact is that an actor has posted its name or file samples.

6. Verify the authenticity of any leaked evidence before reacting publicly. Not every sample published by an actor comes from the company’s real systems. Technical validation should come before internal or external conclusions.

7. Immediately update exposed orchestration and administration platforms. The Arista VeloCloud Orchestrator case is a reminder that management platforms are as critical as endpoints. The existence of active exploitation calls for inventory, prioritization, and rapid patching.

8. Exercise continuity scenarios involving loss of EDI, email, and remote support. In logistics and ports, partial degradation can be as serious as full encryption. Exercises should include manual operations, alternative routes, and escalation criteria.

9. Coordinate cybersecurity, legal, continuity, and communications before the incident. An effective extortion response requires fast decisions on notification, evidence preservation, negotiation, and external messaging. Doing that for the first time during the crisis increases the damage.

10. Monitor digital reputation and leak sites as part of defensive intelligence. Not to count victims, but to detect early whether the organization or its vendors are named. External intelligence should be integrated into the SOC and the crisis team.

Limits and scope

This report is based exclusively on the research material provided. When a source describes a possible victim, a claimed exfiltration, or an unverified access path, that uncertainty is preserved and not presented as a confirmed fact. In particular, the n0n campaign should be read as a set of claims and signals published by third parties and by the tracking ecosystem itself, not as a series of individually confirmed intrusions. Likewise, the regional ransomware figures cited for context do not all correspond to October 2026, some cover broader periods and are included only for explicit comparison.

Telemetry should also not be confused with an incident. Detections, blocked attempts, or vendor averages, when they appear in future sources, are background internet noise filtered through security controls, not proof of compromise. In this report, they are not used as a victim count or as evidence of rising risk. In addition, the absence of a mention in the material reviewed does not mean there was no real activity in the region, it only means it did not appear in the source base reviewed for this period.

Finally, a lack of public confirmation in several cases should not be interpreted as technical innocence or as the end of the episode. In extortion cases, confirmation can take days or weeks, and in many cases it is never published. For security teams, the correct reading is to act on potential risk, not only on impact that has already been demonstrated. That is especially true in transport, ports and logistics, where dependence on third parties, operational pressure and the need for continuity mean that a leak threat is already an operational event in itself.

Frequently Asked Questions

Did the n0n campaign confirm intrusion at all listed companies?

No. The material reviewed shows claims, lists, and publication threats, but it does not independently confirm intrusion or disruption at every organization named. For several of them, the best reading is that there was a public allegation that has not yet been verified, not conclusive proof of technical compromise.

Was there a confirmed encryption case in the transportation and logistics sector in October?

In the material analyzed for this period, there is no confirmed encryption tied to n0n’s maritime campaign. There is a claimed case against a transportation company in Ecuador, but the source does not allow a conclusion that encryption occurred, only that an alleged 501 MB exfiltration and a publication threat were attributed.

What should a CISO do if their company appears on a leak site?

First, verify internally whether there is evidence of real access. Then preserve artifacts, limit changes that could destroy evidence, review third parties and remote access, and activate legal and communications teams. Appearance on a leak site may be only a claim, but it still requires a crisis response.

Does NVIC 02-26 directly affect Latin America?

Not as a local legal obligation, but it does serve as a benchmark for operators with international exposure. Its practical value is in anticipating the level of governance that maritime and port companies will likely be expected to meet by partners, insurers, and global supply chains.

Does the absence of CVEs in the period mean less risk?

No. The absence of CVEs in the material reviewed only means none were recorded in this database for the period. It does not mean there were no critical vulnerabilities exploited in the region. Risk still depends on real exposure, patching, and third-party attack surface.