Cybersecurity firm SOCRadar reported on October 14 that a cyber extortion group calling itself n0n has added 38 shipping, port and logistics organisations to its dark web leak site in a single batch posted on October 12, marking a sharp pivot toward maritime-sector targets. The group has threatened to publish the allegedly stolen material at 13:27 UTC on October 19 unless ransom demands, ranging from roughly $2.4 million to $14 million payable in Bitcoin, are met.
The listed organisations span 18 countries and include container terminal operators, shipping lines, port IT providers and logistics companies. Named entities include Ocean Network Express, CULines, TS Lines and Samudera, alongside terminal operators such as Santos Brasil, Portonave, Busan New Container Terminal and Pusan Newport Company. None of the companies named had publicly confirmed a breach as of the latest reporting, and SOCRadar stressed that n0n’s claims remain unverified.
Scope of the Alleged Breach
The October 12 posting more than doubled n0n’s previously recorded victim count after the group emerged last month listing 21 organisations across telecoms, retail, pharmaceuticals and education. South Korea accounted for the largest single-country concentration, with 12 listings including Busan terminal operators BNCT and Pusan Newport Co. Spain’s TTI Algeciras, Morocco’s Eurogate Tanger and Vietnam’s Nam Dinh Vu Port were also named, alongside Saudi Arabia’s NEOM Ports.
Samples reviewed by researchers reportedly included electronic data interchange messages, container manifests, vessel schedules, gate movement records, bookings, equipment interchange documents and internal system configuration files. Claimed data volumes varied widely, from as little as 60 megabytes attributed to a South Korean logistics company to multi-gigabyte archives linked to larger terminal operators. The breadth and format of the material has fuelled speculation about how the group obtained it.
A Possible Common Entry Point
SOCRadar said the pattern of relatively small, narrowly focused datasets and recurring document types across unrelated companies suggested a possible common point of entry rather than 38 separate network intrusions. Researchers raised the possibility that data had been extracted from a shared application, integration platform or file-transfer service used by multiple maritime operators, rather than through individual breaches of each victim’s core systems.
Analysts drew comparisons with the 2023 MOVEit file-transfer vulnerability exploited by the Cl0p group, which allowed attackers to harvest data from numerous organisations through a single compromised software product, though SOCRadar said it had no evidence directly linking n0n to that or any other known campaign. The group has been described as a financially motivated data-theft extortion operation rather than a conventional ransomware outfit, meaning it may rely on encryption-free extortion built solely around the threat of public disclosure.
Industry Response and Unresolved Questions
As of the most recent reporting, none of the 38 named organisations had issued a public statement confirming that their systems were compromised or that n0n possessed genuine data, and cybersecurity firms have repeatedly cautioned that inclusion on a criminal leak site does not by itself establish that a breach occurred. The leak site reportedly also offers paid access to view negotiation details, a tactic increasingly used by extortion groups to pressure victims and generate publicity.
The maritime sector’s reliance on shared digital infrastructure for container tracking, berth scheduling and customs documentation has drawn growing scrutiny from security researchers, who note that a single compromised vendor platform can expose data belonging to dozens of otherwise unconnected shipping lines and terminals. With the group’s stated deadline set for October 19, affected companies and port authorities face a narrow window to assess exposure before any threatened release.
Why it matters
The incident highlights the shipping industry’s growing exposure to cyber extortion as ports, carriers and logistics providers increasingly depend on shared digital platforms for scheduling, customs and cargo-tracking data. A successful large-scale leak involving container manifests, vessel schedules and terminal configurations could disrupt operations at some of the world’s busiest ports and erode confidence in shared maritime IT systems. Even unverified claims of this scale can prompt costly precautionary security reviews across carriers and terminal operators in multiple countries, underscoring the sector’s vulnerability to supply-chain-style cyberattacks.
Source: Splash247
