n0n Group lists 38 ports, carriers and terminal IT firms, leak deadline 19 October
ONE, Pusan Newport, Eurogate Tanger and ZPMC are among the names; demands run from $2.4m to $14m in Bitcoin
A data-theft extortion group calling itself n0n added 38 maritime and logistics organisations to its leak site on 12 October, in a single batch that more than doubled its public victim count. The entries share one publication time, 13:27 UTC on 19 October, which gives the named companies a seven-day window to pay before the group says it will release their data.
None of the 38 had publicly confirmed an incident by the time the deadline approached, and the claims remain unverified. Ransom demands reviewed by the threat intelligence firm SOCRadar run from $2.4 million to $14 million, payable in Bitcoin to a separate address for each victim.
Who is on the list?
SOCRadar sorts the batch into 12 container terminal and port operators, five port IT, EDI and terminal systems providers, 10 shipping lines and ship operators, eight agencies, logistics firms, depots and surveyors, and three companies in adjacent industries. They are spread across 18 countries, and 12 of the entries are South Korean, among them the Busan New Port terminal operators BNCT and Pusan Newport Company.
The terminal names include Santos Brasil at Santos, Portonave, TTI Algeciras, Eurogate Tanger at Tanger Med, Nam Dinh Vu Port in Hai Phong and NEOM Ports. The carriers include Ocean Network Express, CULines, T.S. Lines, Polaris Shipping and Samudera, and the Chinese crane builder ZPMC is listed among the adjacent firms. The systems providers include ILCS Pelindo, GCS Kuwait and HPC Hamburg Port Consulting.
What data is the group claiming?
The listings describe EDI messages, container manifests, vessel schedules, gate and equipment interchange records, booking messages, terminal system configuration, e-invoices, demurrage records and port disbursement accounts. The volumes are small and application-scoped: 2.4 GB in 108 files for ILCS Pelindo, 1.5 GB in 774 files for Pusan Newport Company, 660 MB for Eurogate Tanger and 23,507 EDI message files for Nam Dinh Vu Port. The largest demand, $14 million, is attached to about 60 MB from EUSU Logistics, so the price does not track the volume. Eurogate Tanger faces a $6 million demand with a 10% entry fee of 5.7 BTC to open a private negotiation room.
How did one group reach 38 companies?
The entry point is not confirmed. SOCRadar points to a shared application, EDI integration, terminal system or file transfer product, citing the narrow data sets and the absence of stealer-log credential matches for many of the maritime victims. The Israeli maritime cyber firm Cydome assessed a possible compromise of a shared environment associated with CLT, a maritime software provider with documented ties to many of the named organisations, and also stressed that the source and scope of the breach remain unconfirmed.
n0n first appeared in September 2026 and had 21 victims across other sectors as of 8 October. SOCRadar lists Russia as its likely country of origin and notes that the group largely avoids deploying traditional ransomware, working instead through data theft and extortion. Its published analysis recommends that operators map shared platforms, rotate SFTP, AS2, VAN and vendor support credentials, and enforce multi-factor authentication on VPN and RDP access.
This story is part of the Maritime Briefing of 19 October 2026.
