n0n lists 38 ports and shipping firms, deadline 19 October
Unverified data-theft extortion claim, demands from 2.4 to 14 million dollars

n0n lists 38 ports and shipping firms, deadline 19 October

Extortion group n0n posted 38 shipping, port, and logistics organizations to its leak site in one batch on 12 October and set a publication deadline of 19 October 2026 at 13:27 UTC. SOCRadar says the claims are unverified. No named company had publicly confirmed a breach when Splash247 and The Loadstar reported the listing on 14 October.

What happened

n0n is a data-theft extortion operation, not a classic ransomware encryptor. It emerged in September 2026. SOCRadar reviewed demands from 2.4 million to 14 million US dollars in bitcoin. The amounts do not track the volume of data claimed. One example cited a 14 million dollar demand against a 60 MB archive, and another a 2.4 million dollar demand against 2.4 GB. The leak site also sells access to a private negotiation room. Eurogate Tanger was allegedly asked to pay 10 percent of a 6 million dollar demand before talks would open.

Named organizations include Ocean Network Express, CULines, TS Lines, Samudera, Santos Brasil, Portonave, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port, and NEOM Ports. The batch spans 18 countries and includes 12 port and container-terminal operators plus 10 shipping lines. South Korea accounts for 12 listings. SOCRadar says the small, application-specific datasets could point to one shared application rather than 38 separate break-ins. That is a hypothesis, not a finding. Maritime security firm Cydome mentioned a possible link to an environment associated with CyberLogitec and said it has not established the origin or extent of any breach.

Who is affected

Directly, the 38 named firms, if the claims are real. Indirectly, anyone who exchanges EDI, container manifests, vessel schedules, gate records, or commercial documents with those terminals and carriers. A shared port-IT provider is the scenario that would turn one intrusion into a regional problem. Treat the list as an allegation until a victim or a forensic firm confirms it.

What to do now

If you run port, terminal, shipping, or logistics IT, identify whether you or a supplier is on the n0n list and preserve logs through 19 October. Do not pay a negotiation-room fee on an unverified claim. Ask EDI and terminal-operating-system vendors whether they have seen unauthorized access since September. Watch for leaked employee accounts and for gate or manifest data offered on criminal forums after the deadline.

  • Map which terminals and carriers your operation exchanges files with, including Morocco, Brazil, Korea, Spain, and Singapore lanes if you use them.
  • Review VPN and vendor access into TOS, EDI translators, and gate systems.
  • Confirm offline backups of manifests and commercial documents exist and were not the only copy on a file-transfer server.
  • Hold the line that these breaches are alleged until a victim confirms them.

Source: Splash247, reporting SOCRadar's 14 October assessment. Shipping firms and ports caught in mass cyber extortion claim.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

YAM Store phishing market disrupted after 1 billion messages
Microsoft and partners seize domains behind CoGUI, Haozi, and Iron Man kits