Cyber-crime group hits 38 shipping and port groups with data leak threat

Cyber extortion group ‘n0n’ has named 38 organisations across the global shipping and ports sector on its dark-web leak site, raising concerns that data may have been stolen.

Cybersecurity firm SOCRadar reported yesterday n0n published the listings in a single batch on 12 October. They included container terminals, shipping lines, port IT providers, and logistics businesses across 18 countries.

None of the maritime organisations named had publicly confirmed a breach at the time of writing.

South Korea accounted for 12 listings, including Busan terminal operators BNCT and Pusan Newport Co. The list included Brazilian port operators Santos Brasil, Portonave, and Superterminais; Singapore-based carrier ONE; China’s CULines; Taiwan’s TS Lines; Spain’s TTI Algeciras; and Morocco’s Eurogate Tanger.

The batch more than doubled n0n’s previously recorded victim count. The group emerged last month, listing 21 organisations across sectors including telecoms, retail, pharmaceuticals, and education.

SOCRadar said the pattern of data described in the listings suggested a possible common point of entry, rather than 38 separate network intrusions. According to the researchers, the relatively small, narrowly focused datasets and recurring document types could indicate information had been taken from an application or integration platform used by multiple organisations.

Reviewed samples included electronic data interchange (EDI) messages, container manifests, vessel schedules, gate movements, and terminal system configuration records. The claimed volumes ranged from 60mb for South Korean logistics company EUSU, to 2.4gb for Indonesia’s ILCS Pelindo.

The absence of matching infostealer credential records for many of the listed companies also complicates the theory that each intrusion began with stolen employee credentials, which SOCRadar identifies as a typical n0n access method.

But it warned that a shared system could extend the potential exposure beyond the organisations named on the leak site. EDI records and manifests can contain information on cargo movements, bookings, and commercial relationships involving shipping lines and other supply chain partners.

The pattern is reminiscent of mass-exploitation campaigns involving file-transfer software vulnerabilities, including the MOVEit Transfer attacks in 2023 and Cleo in 2024. However, SOCRadar said there was no evidence linking n0n to those incidents.

The cybercrime group has set a publication deadline of 19 October at 1.27pm UTC for the maritime listings reviewed by SOCRadar. Its leak site uses countdowns and status labels to pressure victims into paying.

Settlement demands have ranged from $2.4m to $14m, payable in bitcoin. The amounts did not appear to correspond with the volume of data allegedly stolen: EUSU Logistics faced a $14m demand for 60mb, with ILCS Pelindo at $2.4m for 2.4gb.

Some listings also offered victims the option of opening negotiations after paying 10% of the demand.

SOCRadar described n0n as a “financially motivated data-theft extortion operation” that generally avoids traditional ransomware deployment, instead threatening to publish stolen information. Its profile nevertheless includes techniques associated with encryption and interference with recovery, meaning disruptive activity cannot be ruled out.

The group’s claims remain unverified. Of its 21 earlier victims, SOCRadar said 19 remained at the claimed stage, one was listed as negotiating, and one, Chibitek, had experienced a data leak. Therefore, the 19 October deadline could provide the first substantive indication of what information n0n holds, and whether the alleged exposure extends across shared platforms.

SOCRadar warned that maritime businesses that exchange EDI with companies named in the attack should plan for the possibility that their operational data could appear in the 19 October release.

It advised them to identify the port community systems, EDI hubs, and file-transfer services handling their data; to check with providers for potential breaches, patch exposed systems, and investigate unusual access or bulk downloads. It also recommended rotating integration credentials, checking for compromised employee and supplier credentials, enforcing multi-factor authentication on remote access, and removing internet-exposed RDP services.

It also advised firms to prepare communications for customers and regulators in case data is exposed through a third party, and monitor n0n’s activity for further leak-site postings.