LockBit 5.0 has reportedly listed Brazilian maritime company Camorim Serviços Marítimos. The ransomware claim includes a 14-day data leak countdown.

A Brazilian maritime services company has reportedly been listed by the LockBit 5.0 ransomware operation, raising fresh concerns about cybersecurity risks facing companies working across the maritime and logistics sectors.

Camorim Serviços Marítimos, a company based in Brazil, was reportedly added to a LockBit victim listing on September 28, 2026. The claim has subsequently appeared on several cybersecurity monitoring websites.

However, the available information does not independently confirm that a successful ransomware intrusion took place or establish exactly what information may have been accessed or stolen. The initial information appears to originate from a ransomware group’s own leak-site listing.

According to the information shown in the circulating alert, the attackers have reportedly placed a 14-day countdown before potentially publishing data allegedly obtained from the company.

Who Is Camorim Serviços Marítimos?

Camorim Serviços Marítimos is a Brazilian maritime company headquartered in Niterói, Rio de Janeiro.

The company’s official website lists a range of maritime and offshore activities, including port towing, logistics support for offshore platforms, port manoeuvring, cargo transportation, passenger transportation, dredging support and offshore services. The company also operates shipyard facilities and a fleet that includes different types of tugboats and support vessels.

Brazil’s National Waterway Transport Agency, ANTAQ, also lists Camorim Serviços Marítimos as an authorized maritime company, including activities involving port support, maritime support and cabotage.

That makes the reported incident particularly relevant to the maritime industry because companies such as tug operators, offshore-support providers and port-service companies increasingly depend on connected IT systems to coordinate their daily operations.

What Does the LockBit 5.0 Claim Say?

The reported LockBit listing identifies Camorim Serviços Marítimos and its website domain, camorim.com.br, as the alleged victim.

Cybersecurity monitoring services reported that the listing appeared on September 28, with further reports appearing on September 29.

The circulating alert also claims that the attackers have given the company a limited period before allegedly publishing stolen information.

At the time of writing, however, there is no independently verified public evidence establishing the amount or type of data allegedly taken.

This distinction is important in ransomware reporting. A company appearing on a ransomware group’s leak site does not automatically prove that the attackers successfully accessed internal systems or obtained sensitive information. Threat actors can make claims that later turn out to be incomplete, exaggerated or inaccurate.

One cybersecurity monitoring report specifically described the Camorim listing as an unverified claim and noted that neither the breach nor the alleged stolen data had been independently confirmed.

Why Maritime Companies Are Attractive Cyber Targets

The maritime industry is no longer dependent only on traditional shipboard systems.

Modern shipping operations connect vessels, terminals, offices, agents, suppliers and customers through increasingly complex digital networks.

A maritime company may use IT systems for:

• Vessel scheduling
• Port operations
• Cargo documentation
• Crew administration
• Financial transactions
• Maintenance records
• Procurement
• Email communication
• Customer information
• Logistics coordination
• Cloud-based business applications

An attack against an office or logistics provider therefore does not necessarily have to target a ship directly to create operational problems.

For a company involved in port towing or offshore support, even a disruption to basic communication and scheduling systems could potentially create delays in coordinating vessels and personnel.

This is one reason cybersecurity has become an increasingly important part of maritime risk management.

Ransomware Can Become an Operational Problem

Ransomware attacks traditionally involved encrypting files and demanding payment for decryption.

Modern ransomware operations can also use data theft and extortion. In these cases, attackers may attempt to steal company information before disrupting systems and then threaten to publish the data if their demands are not met.

This creates two separate risks for companies.

The first is operational disruption.

Employees may lose access to important systems, files or communication tools.

The second is data exposure.

If sensitive information has actually been stolen, the consequences could potentially continue even after systems are restored.

For maritime businesses, the information held inside corporate networks can include contracts, customer information, invoices, vessel documentation, employee records and operational communications.

The exact information involved in the Camorim case, if any, has not been independently established.

Reports of Credential Exposure

One later cybersecurity report went further, citing intelligence from third-party security researchers and claiming that several employee credentials may have been exposed through infostealer activity.

That report alleged exposure involving passwords and a browser cookie, as well as credentials associated with third-party services. These details have not been independently confirmed by Camorim in the publicly available material reviewed for this article, so they should be treated as allegations rather than established facts.

Credential theft is particularly important in ransomware incidents because attackers do not always need to exploit a sophisticated vulnerability to obtain initial access.

A stolen password, compromised account or successful phishing attack can potentially provide an entry point into a company’s wider digital environment.

The Maritime Industry Needs Stronger Cybersecurity

The reported Camorim case is another reminder that maritime cybersecurity extends far beyond the bridge of a ship.

A vessel can have modern navigation, communication and automation systems while the company operating that vessel may still face serious cyber risks through its shore-based infrastructure.

For shipping companies, port operators, ship managers and maritime service providers, basic security measures remain important.

These include:

• Multi-factor authentication for important accounts
• Strong and unique passwords
• Regular software updates
• Secure backups
• Employee phishing awareness training
• Monitoring of unusual account activity
• Restricting administrative privileges
• Separating critical systems from ordinary office networks
• Regular cybersecurity assessments
• Clear incident-response procedures

Cybersecurity also needs to be considered throughout the wider maritime supply chain rather than only within individual vessels.

What Happens Next?

The reported LockBit listing included a countdown threatening the possible publication of allegedly stolen information.

Whether any data will actually be released remains to be seen.

At present, the available public information does not establish the full scope of the alleged incident, including how attackers may have gained access, whether systems were encrypted, what information may have been taken or whether the alleged data will eventually be published.

Maritime companies and their customers will therefore be watching for further information from Camorim, Brazilian authorities or credible cybersecurity researchers.

For the maritime sector, however, the broader lesson is already clear: cybersecurity is increasingly part of operational safety and business continuity at sea and ashore.

A ransomware attack does not need to take control of a ship’s navigation system to affect maritime operations. Disrupting the shore-based systems supporting vessels, ports, logistics and communications can also create serious operational challenges.

Update

This article may be updated if Camorim Serviços Marítimos, Brazilian authorities or credible cybersecurity researchers publish additional information about the reported incident.