The extortion group n0n added 38 port, terminal, shipping and logistics organisations to its leak site in a single batch on 12 October 2026, including Ocean Network Express, Santos Brasil, Pusan Newport Company, TTI Algeciras, Eurogate Tanger and NEOM Ports. Settlement demands reviewed by SOCRadar range from $2.4 million to $14 million, with a shared publication deadline of 19 October at 13:27 UTC. As of 16 October no listed company has confirmed an intrusion, and the data sets described are small enough that a single shared system, not 38 separate break-ins, is the leading explanation.
Who is n0n?
n0n is a data-extortion operation that appeared in September 2026 and does not deploy encryption. The n0n profile on the Ransomtracker holds 85 listings to date, which already places a one-month-old operation among the more prolific names on the live leak-site index. Its earlier listings, according to SOCRadar’s profile of the group, included Fanatics, Transcom WorldWide, AstraZeneca Türkiye and Argentina’s Ministry of Education; SOCRadar noted that Fanatics and Transcom had not confirmed a breach when its research was published.
Two habits distinguish the group. It publishes placeholders such as “Company #66” with a country flag before it names a target, so the index fills with masked entries that are later replaced. And its documented entry method is credentials harvested by infostealer malware, which is the same route we described in stealer logs explained. SOCRadar notes that this method does not obviously explain the maritime batch, because stealer-log checks returned no credential matches for many of the organisations on it.
What does n0n claim to hold?
n0n claims operational port data rather than the usual HR and finance dumps: EDI archives, container manifests, vessel schedules, gate movement records, shipping documentation, terminal system configuration files, bunker cost calculations and demurrage records. The per-company volumes it advertises are modest. SOCRadar’s review lists 2.4 GB across 108 files for ILCS Pelindo, 1.5 GB across 774 files for Pusan Newport Company, 660 MB across 354 files for Eurogate Tanger, 90 MB across 18 files for BMT IQ, 60 MB across 41 files for EUSU Logistics and 23,507 EDI message files for Nam Dinh Vu Port.
Those figures matter because they are the main evidence for how the group got in. A full network compromise of a container terminal would yield terabytes of mixed data. A few hundred files of EDI messages and schedules looks like the export of one application, repeated 38 times. Splash247 reports that Eurogate Tanger was asked to pay 10% of a $6 million demand just to open a private negotiation channel, which suggests the group is pricing on the companies’ brand names rather than on the files it holds.
Why a shared system is the leading theory
The Ransomtracker recorded all 38 maritime entries within two minutes of each other, starting at 17:33 UTC on 12 October, and the data categories repeat from entry to entry. SOCRadar’s assessment is that the batch most likely stems from one exposed application or vulnerability shared across the group. Maritime security firm Cydome has pointed to a possible link with software from CyberLogitec, while stating that it “has not established the origin or extent of any breach”. Port community systems, carrier booking platforms and terminal operating systems all connect dozens of operators to one vendor, and a single credential or flaw in such a system would produce exactly this shape of listing.
Our tracker’s country breakdown supports the supply-chain reading. Twelve of the 38 organisations are in South Korea, four each in Indonesia and Brazil, two each in Singapore, China and Japan, and one each in Türkiye, Hong Kong, the Netherlands, Taiwan, Germany, Saudi Arabia, Kuwait, India, Spain, the United Kingdom, Morocco and Vietnam. Busan alone accounts for several entries: BNCT, Pusan Newport Company and the port community IT provider GNCNet / DGT Busan. That concentration is more consistent with a regional software vendor than with a worldwide campaign of individual intrusions.
Free tool
How does your own site score?
Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
What should listed companies do?
Listed companies should treat the claim as unverified but act as if their EDI and port community integrations are exposed. That means rotating the credentials and API keys used by shared logistics platforms, pulling access logs for those systems back to early October, and asking vendors directly whether their tenants were affected. Because n0n’s documented entry route is stolen credentials, a check of circulating stealer logs is cheap and worthwhile. Stealercheck, which queries the Alerts.bar index that Ransomnews licenses, shows 397 staff-account credentials and 7,476 session cookies associated with one-line.com, and 25 staff credentials for santosbrasil.com.br. Those are aggregate exposure counts from infostealer logs collected over time, not evidence of this intrusion, but they show how much of the sector’s workforce already has credentials in circulation.
What this means for the maritime sector
The maritime batch is a reminder that supply-chain extortion scales better than ransomware. A single access point, if that is what this was, produced 38 ransom demands with no encryption, no disruption and, so far, no confirmed intrusion, which is a good return for the operator and a difficult position for the companies named. If a shared vendor is confirmed, the realistic exposure is commercial: schedules, manifests and contract terms, rather than personal data. If it is not, each company has to prove a negative to its customers while a countdown runs. Either way, the 19 October deadline will tell us whether n0n actually holds what it advertises. We will update the 2026 year archive and the daily digest as the entries change status.
Frequently asked questions
Has any port or shipping company confirmed the n0n breach?
No listed company had confirmed an intrusion as of 16 October 2026. SOCRadar, which first reported the batch, describes the claims as unverified until data is published or a victim confirms them.
How much is n0n demanding from the maritime companies?
Demands seen by SOCRadar range from $2.4 million to $14 million, payable in Bitcoin. Eurogate Tanger was reportedly asked for 10% of a $6 million demand before being allowed into a negotiation room.
Is n0n a ransomware group?
n0n is an extortion group rather than a ransomware group. It takes data and threatens publication but has not been observed encrypting systems, which places it with the pure-extortion operators we described in our analysis of the shift away from encryption.
Which shipping lines are on the n0n list?
The listing names Ocean Network Express, CULines, T.S. Lines, Samudera, Polaris Shipping, Dong-A Tanker, Korea Ferry and Camellia Line among the carriers, alongside terminal operators such as Santos Brasil, Portonave, Superterminais, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port and NEOM Ports.
When will n0n publish the data?
The maritime entries share a single countdown that expires on 19 October 2026 at 13:27 UTC. SOCRadar reports that the group has already published data for at least one earlier target, Chibitek, so the threat is not an empty one.
Sources and further reading
- SOCRadar, n0n group puts dozens of global ports and shipping on its leak site
- Industrial Cyber, n0n extortion claims target 38 global maritime and logistics organizations
- Splash247, Shipping firms and ports caught in mass cyber extortion claim
- SAFETY4SEA, Cyber extortion group targets 38 maritime organizations
- Ransomnews Ransomtracker, n0n operator profile, listings recorded 12 to 15 October 2026
- Related: initial access brokers and the 2026 ransomware supply chain, and the threat-group catalogue
Reporting by the Ransomnews Research Team. Exposure figures are aggregate counts from the Alerts.bar index, an independent provider whose data Ransomnews licenses; no credentials are reproduced and no leak-site content is linked.
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.