A previously little-known extortion group, n0n, has produced one of the largest single-sector leak-site postings of autumn 2026. On October 12 it listed 38 maritime, port and logistics organizations in one batch and set a payment deadline of October 19. That deadline has now passed. As of mid-October reporting, none of the named organizations had publicly confirmed a breach, so every claim below should be read as an attacker assertion, not an established incident.
Why it matters now
Port and shipping operators sit on data that is valuable beyond ransom: cargo manifests, release documents and terminal configuration. Because the listing hit dozens of firms at once, the pattern raises a question defenders in the sector should care about: was this 38 separate intrusions, or one upstream exposure? SOCRadar’s analysis, as summarised by The Loadstar and others, leans toward the latter, but this is unconfirmed.
Background
SOCRadar characterizes n0n as a data-theft extortion operation, and Greek outlet Naftemporiki, as cited by secondary coverage, reports that the group emerged in September 2026. Public reporting offers no reliable information on operators, affiliations, lineage from older groups, or the tooling behind its claims. We do not attribute it to any prior brand. The Loadstar notes that its profile includes techniques associated with encryption and recovery interference, so disruptive activity cannot be ruled out, though no encryption or operational disruption has been reported.
The maritime batch
According to reporting by Maritime Executive, The Loadstar and SOCRadar:
- Posted: October 12, 2026, as a single batch. Deadline: October 19.
- Scale: 38 organizations in 18 countries, with South Korea accounting for 12 entries. Secondary reporting breaks the list down as roughly 12 port or container-terminal operators, 10 shipping lines or shipowners, and the remainder IT providers, logistics firms and service companies.
- Named entities in coverage include Ocean Network Express, CULines, T.S. Lines, Samudera, Santos Brasil, Portonave, Pusan Newport Company (BNCT) and Eurogate Tanger.
- Demands: $2.4 million to $14 million per organization, payable in Bitcoin. The Loadstar observed that amounts did not appear to track the volume of data allegedly stolen, and some listings reportedly offered victims the chance to open negotiations after paying 10% of the demand.
- Claimed data: EDI messages, cargo manifests, gate and equipment-interchange records, terminal-system configuration data, release documents and deployment material tied to maritime operating systems.
TTPs: what is and is not known
No initial access vector has been published. SOCRadar’s assessment is that the claimed data resembles application-level exposure from a shared system rather than 38 independent network compromises. If correct, the common factor could be a shared platform, vendor or integration layer, though that has not been demonstrated. The group’s pattern is classic data-only extortion: public listing, countdown, payment demand, and a status marker on leak entries. No malware, encryption behavior or infrastructure indicators have been reliably documented, and we are not listing IOCs that we cannot source.
Other claimed victims
Outside shipping, aggregators report n0n listings against a US fintech firm (claiming exposed network configuration and access secrets for payment infrastructure), The Akeeli Group, a US investigation-services firm, and an accounting provider, All Business Technologies, reportedly with tax records of more than 60 client companies. DeXpose reports the Akeeli entry as marked “NOT PAID - EXPOSED,” suggesting data publication after non-payment. These are aggregator-sourced claims and were not independently verified.
Impact assessment
No operational disruption has been reported at any listed port or carrier. The realistic near-term risks are data publication, targeted phishing and fraud using genuine shipment documents, and cargo-release manipulation. Whether any data was released after October 19 was not confirmed at the time of writing.
Defensive takeaways
- Inventory shared platforms. Identify third-party portals, EDI gateways and terminal-system integrations that hold data for multiple parties, and review their exposure and logging first.
- Check your name against leak monitoring. Ask vendors and peers whether they have been listed; absence of confirmation from victims is not evidence of absence of compromise.
- Harden document-release workflows. Add out-of-band verification for release orders and payment-detail changes, since stolen manifests and release documents enable convincing fraud.
- Rotate secrets tied to claimed exposure. Where configuration data or access secrets may be affected, rotate credentials and API keys and review access logs.
- Prepare communications. Pre-agree regulator, customer and partner notification paths so a leak-site listing can be triaged quickly.
- Do not assume no encryption. Keep offline backups and recovery testing current, given that the group’s reported profile includes recovery-interference techniques.
Confidence and caveats
This profile relies on secondary reporting and a threat-intelligence vendor’s analysis. The existence of the listing is well corroborated across outlets; the existence of compromise, the data’s authenticity and the attack path are not. We will update this entry if victims confirm incidents or if primary technical analysis emerges.
Sources
- SOCRadar, “n0n Group global ports shipping leak”: https://socradar.io/blog/n0n-group-global-ports-shipping-leak/
- Maritime Executive, “Massive cyber attack threatens release of data from 38 maritime companies”: https://maritime-executive.com/article/massive-cyber-attack-threatens-release-of-data-from-38-maritime-companies
- The Loadstar, “Cyber-crime group hits 38 shipping and port groups with data leak threat”: https://theloadstar.com/cyber-crime-group-hits-38-shipping-and-port-groups-with-date-leak-threat/
- Beinsure: https://beinsure.com/news/hackers-threaten-38-shipping-port-firms/
- Tech Insider (aggregation): https://tech-insider.org/n0n-group-ransomware-maritime-firms-2026/
- DeXpose, Akeeli Group listing: https://www.dexpose.io/n0n-ransomware-targets-the-akeeli-group/