Cyber extortion group targets 38 maritime organizations

Cyber extortion group n0n has listed 38 maritime and logistics organizations across 18 countries on its dark web leak site, raising concerns potential vulnerabilities affecting interconnected shipping and port systems.

A ccording to cybersecurity intelligence tracked by SOCRadar, the October 12, 2026, batch includes container terminals, shipping lines, port IT providers and logistics companies. Named organizations include Ocean Network Express, CULines, T.S. Lines, Santos Brasil, TTI Algeciras and Eurogate Tanger.

South Korea accounts for 12 listings, including terminal operators, shipping companies and port IT providers. The concentration has raised questions whether the alleged data exposures resulted from separate intrusions or a shared application or vulnerability.

However, the available evidence does not establish a common entry point, and none of the maritime claims had been publicly confirmed by the listed organizations at the time of writing.

The group, which emerged in September 2026, reportedly focuses on stealing data and threatening public disclosure rather than relying primarily on conventional ransomware deployment. Its latest listings threaten to publish the alleged stolen information on October 19, 2026, at 13:27 UTC, with reviewed ransom demands ranging from US$2.4 million to US$14 million.

The incident highlights the potential risks posed by third-party cyber vulnerabilities across the maritime supply chain, particularly where port IT providers and terminal systems handle information for multiple operators. CYTUR in its 2026 Maritime Cyber Threat White Paper found that cyber incidents in 2025 surged by 103%, emerging as a critical threat to maritime safety . Distributed Denial of Service (DDoS), ransomware, and malware infections account for the majority of these attacks, with their growth rate more than doubling over the past year.