A cyber extortion group has claimed it obtained data from 38 shipping, port and logistics companies and has threatened to publish the material unless ransom demands are met by October 19.
Cybersecurity firm SOCRadar said the group, known as n0n, listed all 38 organisations on its dark-web leak site in a single batch on October 12. The move marked what SOCRadar described as a significant focus on maritime-sector targets.
The organisations named by the group span 18 countries and include 12 port and container terminal operators, 10 shipping lines and ship operators, port IT providers, logistics companies and other maritime businesses.
Operational context
Companies listed include Ocean Network Express, CULines, TS Lines and Samudera. Terminal operators named include Santos Brasil, Portonave, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port and NEOM Ports.
However, the alleged compromises have not been independently confirmed. SOCRadar said none of the maritime companies named on the leak site had publicly confirmed that their systems were breached or that n0n holds the data it claims to possess. The cybersecurity firm said the group’s statements should therefore be regarded as unverified.
n0n is described as a financially motivated data-theft extortion operation, rather than a conventional ransomware group. According to SOCRadar, the group has threatened to release the alleged data at 13:27 UTC on October 19.
SOCRadar said the ransom demands it reviewed ranged from $2.4 million to $14 million, with payments requested in Bitcoin. The group’s leak platform also appears to offer paid access to negotiations. In an example cited by SOCRadar, Eurogate Tanger was allegedly asked to pay 10% of a $6 million demand before access to a private negotiation room would be provided.
The data allegedly held by the group differs between the listed companies. Claimed material includes EDI archives, container manifests, vessel schedules, gate-movement records, commercial documents, internal system configurations, employee accounts and financial records. There is no confirmation that the datasets are authentic, complete or recently obtained.
SOCRadar said that the reportedly limited and application-specific nature of some datasets could point to a shared application or common vulnerability, rather than 38 separate breaches. That assessment also remains unconfirmed.
Maritime cybersecurity company Cydome has indicated a possible connection to software supplied by CyberLogitec, while stressing that it has not established either the source or the scale of any potential breach.