Northbridge Ferry Systems Data Breach

An attacker reused credentials harvested from an unrelated breach to reach the administrative console of Northbridge's ticketing vendor, and from there exported the rider table in full. The export covered every account created since the app launched, including accounts closed years earlier, because the vendor retained closed records against a future reconciliation that never happened.

The operator confirmed an incident on 2026-03-21 and said a third-party investigation was under way. The dataset was observed in open circulation on 2026-04-02, which is the date this record is scored against rather than the date of the announcement.

Counts are not compared: the notice counts people, the dataset counts account rows. The score is built only on what is seen circulating.

Fourteen field types are present. Five of them cannot be reissued: government identity number, date of birth, the residential address, the vehicle registration and the dependent records attached to family accounts. The remaining nine are rotatable in principle, though the sailing history is not meaningfully rotatable in practice because it is a record of what already happened.

Shelf life is how long a field stays useful to someone holding it. A password expires fast. A government ID number or a date of birth lasts for years. An address stays useful long after it stops being current.

Identity proofing is the first use. The combination clears most knowledge-based verification without any further research, because it carries the name, the date of birth, the address and a document number together.

Physical targeting is the second and the reason this record scores where it does. A named individual, a residential address and a dependable schedule of absences is a different category of exposure from a credential dump, and it is not addressed by anything a consumer can rotate.

For a protected person, the exposure of concern is not fraud. It is that a two-year movement pattern against a residential address supports surveillance planning by someone who has never been near either.

Where a principal's household or staff hold accounts on the same service, treat those as in scope. The pattern that matters is frequently the assistant's, not the principal's.

Attributed to the Rowhammer Collective on the basis of the posting account and the tooling, at moderate confidence. The group has no established record of fabricating victims, but attribution here rests on tradecraft rather than on an admission, and the volume figure originates with the actor.

Northbridge runs scheduled commuter and vehicle services across three coastal counties on a fleet of nine vessels, carrying roughly 2.4 million passenger journeys a year. Ticketing moved to a single app in 2019, and the app became the only route to a discounted fare, which is why the account base is close to the whole regular ridership rather than a subset of it.

A ferry ticket is a reservation for a named person on a dated sailing, and a vehicle ticket adds a registration plate and a vehicle length. Concession fares require proof of age, residence or disability, which is why government identity documents sit in the same table as the payment card.

None of this is unusual for a transport operator. It is the reason the combination is unusually rich: identity, payment, residence and a two-year pattern of movement, assembled by the ordinary operation of a ticketing app.

Confirmation against the corpus, so you know whether your own data is in the set rather than whether the set exists. Exposure mapping and removal across the brokers that will ingest it. Monitoring tuned to the fields this breach actually exposed, rather than to the company's name.