n0n Group Threatens to Leak Data from 38 Maritime and Port Companies

The cybercriminal group n0n, which specializes in data theft and extortion, posted on October 12 on a dark web site the names of 38 organizations in the maritime and port sector, demanding ransom payments in Bitcoin before October 19 under threat of disclosing the information it claims to have stolen. According to cybersecurity firm SOCRadar, the demands range from US$2.4 million to US$14 million depending on the volume of data the group claims to hold on each victim.

The list includes shipping lines such as Ocean Network Express (ONE), CULines, T.S. Lines and Samudera, along with port and terminal operators such as Santos Brasil, Portonave and Superterminais in Brazil, TTI Algeciras in Spain, Eurogate Tanger in Morocco, and South Korea's BNCT and Pusan Newport Company. Also listed are technology providers such as ILCS Pelindo, HPC Hamburg Port Consulting and T2S, as well as Chinese crane manufacturer ZPMC. According to Mundo Marítimo, the 38 organizations belong to 18 countries, with South Korea accounting for 12 of the cases.

SOCRadar maintains that the exposure could stem from a system or application shared among several of the organizations, rather than 38 independent breaches, although this hypothesis has not been confirmed. The compromised data reportedly includes EDI messages, manifests, equipment interchange records, terminal system configurations and cargo release documents; as an example, n0n claims to hold 23,507 EDI files from Nam Dinh Vu Port in Vietnam, and 1.5 GB of documents from Pusan Newport Company. Israeli firm Cydome stated that its assessment points to a possible compromise of a shared environment associated with CLT, a maritime software provider linked to many of the organizations named, although the exact origin and scope remain unconfirmed.

Analyst Lars Jensen warned that this is a case of pressure aimed at securing a ransom payment, and that companies must assess whether the threat is real or a bluff by criminals hoping a frightened company will pay. Cydome recommended that maritime operators review their vendors' exposure, the access granted to them, and credentials shared through support channels.

The n0n Group emerged in September 2026 and, according to SOCRadar, does not deploy traditional ransomware but instead manipulates victims' data using administration tools to force payment. Prior to this attack, the firm attributes to it the compromise of 21 organizations in sectors such as investment, telecommunications, retail, education and pharmaceuticals across 17 countries, of which one case entered negotiations and another ended in data disclosure. So far, none of the 38 organizations in the maritime and port sector has publicly confirmed having suffered the breach.