Shipping firms and ports caught in mass cyber extortion claim

A cyber extortion group has threatened to publish data it claims it stole from 38 shipping, port, and logistics companies unless they pay multimillion-dollar ransoms by October 19.

Cybersecurity firm SOCRadar said the group, known as n0n, added the 38 organisations to its dark web leak site in a single batch on October 12, marking a sharp shift towards maritime targets.

The list includes 12 port and container terminal operators, 10 shipping lines and ship operators, port IT providers, logistics companies, and other maritime businesses across 18 countries.

The list includes Ocean Network Express, CULines, TS Lines, and Samudera, as well as terminal operators Santos Brasil, Portonave, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port, and NEOM Ports. However, the alleged breaches have not been independently verified.

SOCRadar stressed that none of the listed maritime companies had publicly confirmed that their systems had been compromised or that n0n possessed the data it claims to hold. The cybersecurity firm said the group’s claims should therefore be treated as unverified.

n0n is described as a financially motivated data-theft extortion operation rather than a conventional ransomware group.

The group is threatening to release the alleged stolen material at 13:27 UTC on October 19. SOCRadar said ransom demands it reviewed ranged from $2.4m to $14m, payable in Bitcoin.

Its leak site also offers what amounts to pay access to negotiations. In one example SOCRadar cited, Eurogate Tanger was allegedly asked to pay 10% of a $6m demand before being given access to a private negotiation room.

The data n0n claims to possess varies between companies and includes EDI archives, container manifests, vessel schedules, gate movement records, commercial documents, internal system configurations, employee accounts, and financial records. No one has confirmed that these datasets are genuine, complete, or recently obtained.

SOCRadar said the relatively small, application-specific datasets claimed for several victims could indicate a common application or shared vulnerability rather than 38 separate compromises, although this too remains unconfirmed.

Maritime cybersecurity company Cydome has pointed to a possible link to an environment associated with maritime software provider CyberLogitec but has stressed that it has not established the origin or extent of any breach.