- Cyber extortion group n0n has named 38 maritime organizations as alleged victims, including shipping lines, port operators, terminal companies and equipment manufacturers.
- The attackers are demanding Bitcoin payments ranging from $2.4 mn to $14 mn by October 19, 2026, threatening to release stolen information if the demands are not met.
- Cybersecurity firms SOCRadar and Cydome suspect the incident may involve a compromised shared maritime software environment, although the source and extent of the breach remain unconfirmed.
A newly identified cyber extortion group has threatened to publish allegedly stolen data from 38 maritime organizations unless they pay multimillion-dollar ransoms, raising concerns about a possible shared-system breach affecting international shipping operations.
The group, known as n0n, published the names of the alleged victims on a dark web site on October 12, 2026, giving them until October 19 to make payments in Bitcoin.
According to cybersecurity firm SOCRadar, ransom demands range from $2.4 mn to $14 mn, depending on the volume of data the attackers claim to possess. The group has indicated that some payment demands may be negotiable.
The list includes offices of major shipping companies, including Singapore-based Ocean Network Express (ONE), CULines and T.S. Lines, alongside maritime businesses in South Korea, Japan and Indonesia.
Ports and terminal operators in India, Saudi Arabia, Spain, Brazil and Vietnam were also named. Other alleged victims include shipping support agencies and Chinese port crane manufacturer ZPMC.
None of the 38 organizations has publicly confirmed that its systems were compromised.
SOCRadar’s investigation suggests the incident may have originated from a single shared technology environment rather than separate attacks against each organization.
The allegedly compromised information includes electronic data interchange (EDI) messages, shipping manifests, gate and equipment interchange records, terminal system configurations, cargo release documents and deployment materials.
These records are used in shipping and terminal operations, making their potential exposure a concern for companies relying on interconnected maritime systems.
Israeli maritime cybersecurity company Cydome independently examined the claims and identified a possible connection to a shared software environment.
“Our assessment points to a possible compromise of a shared environment associated with CLT, a maritime software provider with documented ties to many of the named organizations. The source and scope remain unconfirmed,” Cydome said.
SOCRadar noted similarities with mass-exploitation extortion campaigns observed in 2023 and 2024, when vulnerabilities in widely deployed file transfer software allowed attackers to compromise data belonging to multiple organizations through common technology platforms.
The firm also reported that n0n appears to favor data theft and extortion over conventional ransomware development, using administrative tools to manipulate compromised information.
The group first emerged in September 2026 and is believed by SOCRadar to be operating from Russia, although its location has not been independently established.
Before the maritime incident, the group reportedly targeted 21 organizations across 17 countries, including companies in investment services, telecommunications, retail, education and pharmaceuticals.
Its latest campaign appears concentrated on Asian maritime businesses, although the list of alleged victims extends across several continents.
Investigators have yet to establish whether the attackers accessed the systems of all 38 named organizations or obtained their information through a common third-party platform.
The October 19 deadline represents the immediate concern for the listed companies, which face threats of data publication despite the absence of publicly confirmed breaches.
For maritime cybersecurity specialists, the central question remains whether the incident involves individual company compromises or a single software environment containing operational records from multiple shipping and port businesses.
n0n is a financially motivated cyber extortion group focuses on data theft and extortion without relying on traditional ransomware. They gain unauthorized access to corporate networks to threaten public disclosure of stolen data, targeting entities across various sectors worldwide.
