Santos Brasil listed among N0n victims

Update November 3, 2026: Cyberint broadened its view of N0n and said that, as of Oct. 19, 2026, the largest public tracker it reviewed showed 120 victims in 28 countries. The firm also said observed ransom demands tied to the group ranged from $2.4 million to $25 million.

Santos Brasil remains listed as a presumed victim of the emerging N0n group, while new references expand the reach attributed to the campaign. Ransomware.live listed the Brazilian port operations company as a possible victim, with database scripts from the terminal operating system and operational records cited as exposed, although there is no independent official confirmation.

What did SecurityArsenal say about the N0n campaign?

SecurityArsenal reported that N0n posted a wave of claims on its leak site with an unusual concentration in maritime transport, port operations, container shipping, and logistics. The analysis notes that those claims were observed by a second crawler, but that does not confirm the organizations were compromised.

The same source included Santos Brasil among the organizations whose alleged intrusion was claimed by N0n. It also said the wave covered entities in several countries tied to the global maritime supply chain, though it did not provide additional specific evidence about the data attributed to the Brazilian company.

What do CISO AI and FalconFeeds.io add?

CISO AI described a wave of 38 organizations added to n0n's leak site and interpreted it as a possible shift toward sector concentration in maritime transport and logistics. That text attributes a profile to SOCRadar in which the group would use credentials obtained through infostealers and administrative tools, but that does not show those techniques were used against Santos Brasil.

FalconFeeds.io, meanwhile, listed Santos Brasil alongside other Brazilian port and maritime companies, including Portonave and Super Terminais, as part of a reported batch of 32 new n0n victims. The available result is a social media post and does not include confirmation from the affected companies.

What does Cyberint's review add?

Cyberint said that, as of Oct. 19, 2026, the largest public tracker it reviewed showed 120 N0n victims in 28 countries. The same research said observed ransom demands for the group ranged from $2.4 million to $25 million, two figures that add context to the campaign but do not change Santos Brasil's status as a presumed victim.

Taken together, the reports place Santos Brasil within a campaign that several sources link to the maritime and logistics sectors, but the level of verification remains uneven. In the Brazilian company's case, the sources reviewed support the attribution with varying degrees of caution and do not provide independent official confirmation.