n0n Extortion Group Lists 38 Maritime Organizations, Suggests Shared-System Exposure

Summary

n0n listed 38 port, shipping and logistics organizations on its leak site, with data publication threatened for October 19, 2026. SOCRadar says the claims are unverified but may point to a shared application or vulnerability.

Key points

• The group posted the 38 organizations in one batch on October 12, 2026; South Korea accounted for 12 listings.
• The listed organizations span port operators, shipping lines, logistics firms and providers of port IT and terminal systems.
• Reviewed claims describe narrow data sets, including EDI messages, manifests and system configuration material; SOCRadar says this may indicate a shared application or access path rather than separate intrusions.
• SOCRadar found no infostealer credential matches for many of the maritime organizations, but the access method has not been confirmed.
• The group threatened to publish the maritime data on October 19, 2026, at 13:27 UTC; reviewed demands ranged from USD 2.4 million to USD 14 million.
• No listed maritime organization had publicly confirmed an incident at the time of writing, and the claims remain unverified.
• The article advises organizations to review shared EDI and file-transfer platforms, patch exposed systems, rotate integration credentials, and prepare for possible partner-data exposure.

Threat Actors

Countries

Industries

Related Articles

• Ransomware Disclosures Fell to 862 in September as Affiliates Continued Evolving Their TacticsN0n
• N0n Claims Chibitek Data Exposure, Including Client Records and Network CredentialsN0n
• N0n Claims Ransomware Attack on Michigan Cannabis OperatorN0n
• N0n Claims Ransomware Activity at California Smart-Building ProviderN0n
• N0n Claims Ransomware Attack on NSW Neurology Practice; Data Exposure PendingN0n