n0n Group Extortion Explained: What the 38-Firm Shipping Threat Means

WarBrief Live | October 17, 2026 | Cybersecurity

A cyber extortion group calling itself n0n claims it has stolen operational data from 38 shipping lines, port terminals and logistics firms across 18 countries, threatening to publish it on October 19 unless paid $2.4 million to $14 million per organization in Bitcoin. That is what the group claims. What is verified: on October 12, 2026, n0n posted 38 maritime organizations to its dark-web leak site in one batch with a uniform deadline of October 19, 2026 at 13:27 UTC, and settlement demands reviewed by SOCRadar. What is not verified: whether any of the 38 was actually breached — none has publicly confirmed a compromise, and SOCRadar cautions the claims should be treated as unverified.

This n0n ransomware maritime shipping extortion case is unusual: the group is under two months old, and SOCRadar and Cydome suspect the 38 victims may share one compromised software environment rather than 38 separate intrusions. Here is what is confirmed, what remains unverified, and what the October 19 deadline could reveal.

What is the n0n ransomware group?

n0n is a financially motivated data-theft extortion group that emerged in September 2026, according to SOCRadar’s tracker profile. Rather than encrypting a victim’s files and selling a decryption key, n0n claims to copy data and threatens to publish it on a dark-web leak site unless it is paid. SOCRadar describes an operation that gains initial access with credentials harvested by infostealer malware, exfiltrates material such as Active Directory mappings and legal documents, and applies pressure through public postings. The group avoids traditional ransomware deployment and instead manipulates victim data with administrative tools, though its attack mapping still includes encryption and recovery-inhibition techniques, so disruptive impact cannot be ruled out.

Before the maritime wave, n0n was broad and opportunistic: 21 listings across 17 countries, including claims against Fanatics, Transcom WorldWide and Argentina’s Ministry of Education. Of those 21, SOCRadar says 19 remained at the “claimed” stage, one was negotiating, and one, Chibitek, had data leaked — none publicly confirmed by the named companies. That is why the October 19 deadline matters: it could provide the first substantive indication of what n0n actually holds.

What is the n0n group’s deadline for the shipping firms?

Every maritime listing carries the same status — “NOT PAID, EXPOSED” — and the same countdown: publication at 13:27 UTC on October 19, 2026. The uniform deadline is itself a signal, as The Loadstar reported: a single seven-day window for 38 named victims is consistent with a batch processed at once, which supports the theory of a common data source. The leak site works as a public scoreboard — “PENDING EXPOSURE”, “NOT PAID, EXPOSED” and “HONORED” for victims that settled.

The detail pages reviewed by SOCRadar set a fixed settlement amount in US dollars with its Bitcoin equivalent and a dedicated Bitcoin address. Negotiation is available — at a price: the Eurogate Tanger and ILCS Pelindo pages offer a one-time option to send 10% of the settlement amount to the same address, then use the transaction ID to claim a private negotiation room. For Eurogate Tanger that entry fee is 5.7 BTC, roughly $600,000; for ILCS Pelindo, 2.3 BTC, roughly $240,000. Demands do not scale with data volume: EUSU Logistics faces the highest demand reviewed, $14 million, for a claimed 60 MB, while ILCS Pelindo faces $2.4 million for 2.4 GB — the price appears set by perceived victim capacity, not the data itself.

By the numbers: what n0n claims versus what is verified

The figures below separate what investigators and trade press have verified from what rests solely on the extortion group’s claims.

Caveat: figures marked REPORTED rest on n0n’s own leak-site claims as reviewed by SOCRadar — none of the 38 named organizations has publicly confirmed a breach, so treat the underlying claims as unverified until data is published or a victim confirms.

Which shipping companies are named in the n0n leak list?

The 38 organizations cover almost every link in the container supply chain. The shipping lines named include Singapore-based Ocean Network Express (ONE), China’s CULines, Taiwan’s T.S. Lines, South Korea’s Polaris Shipping, Dong-A Tanker, Samjoo Maritime and Korea Ferry, Japan’s Camellia Line and Tsuneishi/Kambara Kisen, and Indonesia’s Samudera, according to SOCRadar’s review of the listings. Terminal operators include Santos Brasil, Portonave and Superterminais in Brazil; Asyaport in Turkey; BNCT and Pusan Newport Company in South Korea; TTI Algeciras in Spain; Eurogate Tanger in Morocco; NCT Kandla in India; Nam Dinh Vu Port in Vietnam; and NEOM Ports in Saudi Arabia.

Also named are port IT, EDI and terminal systems providers — including GNCNet/DGT Busan, GCS Kuwait, ILCS Pelindo, HPC Hamburg Port Consulting and T2S Brazil — plus China’s ZPMC, the port crane manufacturer under ongoing US scrutiny. South Korea dominates with 12 entries, unusual for a country where SOCRadar’s research found ransomware targeting weighted toward finance and manufacturing, not maritime.

How did n0n allegedly get the maritime data?

This is the question researchers treat as the most important — and their answer is a theory, not a fact. SOCRadar’s review points to a single shared entry point, such as an exposed shared application or vulnerability, rather than 38 separate intrusions. Three observations support it: the volumes (60 MB to 2.4 GB) look like a single application’s data store, not compromised networks; the same narrow categories — EDI messages, manifests, gate records, terminal configuration — recur across countries; and SOCRadar found no infostealer credential matches for many listed organizations, so stolen credentials do not explain the batch.

The likeliest source is a platform many of these organizations share — a terminal system, EDI integration or file-transfer product reached through a vulnerability. Beinsure reports that Israeli maritime cybersecurity firm Cydome independently reached the same conclusion. A shared source widens exposure beyond the 38 names: the Nam Dinh Vu Port posting alone describes 23,507 EDI message files exchanged with multiple international shipping lines — its archive would expose the cargo flows and booking relationships of every carrier that called at the terminal.

Why is port and terminal data so valuable to extortionists?

Port data is the nervous system of global trade, which is why it commands million-dollar demands. EDI messages, shipping manifests, gate movement records, vessel schedules and terminal system configurations reveal who is shipping what, where, when and for how much; bunker cost calculations, demurrage and despatch records, and port disbursement accounts expose commercial relationships and margins. In the wrong hands, that data enables cargo theft, sanctions evasion, invoice fraud and competitive intelligence gathering — which is why Industrial Cyber flags the exposure as a sector-wide concern, not 38 isolated incidents — especially with the sector already under pressure from Red Sea attacks and the Hormuz confrontation.

What the n0n maritime extortion means for US/UK/EU readers

This story reaches beyond the shipping industry through three channels: supply-chain costs, port security and compliance risk. If the October 19 release exposes terminal system configurations and cargo-flow data, affected terminals face remediation and legal costs that flow downstream into freight rates — on top of already elevated shipping insurance and fuel costs from Red Sea rerouting and the Hormuz confrontation, and ultimately onto consumer prices for imported goods.

Several named terminals sit at Europe’s doorstep — TTI Algeciras in Spain and Eurogate Tanger in Morocco, both gateways for EU trade. A confirmed compromise at Algeciras would be a European port-security incident landing on regulators already tightening critical-infrastructure cyber rules. And paying the ransom is no clean decision: paying a group assessed as likely Russian carries US/UK sanctions exposure — OFAC has penalized ransomware payments before. For US/UK/EU companies exchanging EDI with the named firms, the immediate move is vendor-risk review, not negotiation.

How should maritime firms respond before the October 19 deadline?

SOCRadar’s defensive checklist starts with one assumption: listed or not, any organization that exchanges EDI with the named companies should plan for its operational data to appear in the release. The recommended steps: map the shared platforms carrying your data and ask those vendors directly whether they are investigating; patch internet-facing EDI and terminal system components; rotate integration credentials; check stealer logs; and enforce multi-factor authentication on remote access.

Whether October 19 produces a genuine data dump, a partial leak, or nothing will answer the central question: is n0n holding real data, or bluffing with templated listings? Either way, this campaign has mapped the sector’s shared-platform exposure in public. n0n fits a trend WarBrief has covered before — our breakdown of the IDCF Cloud ransomware campaign, which hit 495 firms, showed how one entry point scales into hundreds of victims, the same dynamic suspected here, and Microsoft’s takedown of the YAM Store phishing operation illustrated how defenders fight back at the infrastructure level. For the intelligence workflow behind assessments like this one, see our threat intelligence services guide, and follow our Conflict Zones hub and Intelligence Reports hub as this story develops.

Frequently asked questions

What is the n0n ransomware group?
n0n is a financially motivated cyber extortion group that emerged in September 2026, per threat-intelligence firm SOCRadar. Unlike traditional ransomware gangs, it generally does not encrypt files; it claims to steal data and threatens to publish it on a dark-web leak site unless paid. SOCRadar assesses the group as likely Russia-based.

What is the n0n group’s deadline for the shipping firms?
The maritime listings carry a uniform publication deadline of October 19, 2026, at 13:27 UTC. The group threatens to publish the allegedly stolen data unless settlement demands — reported at $2.4 million to $14 million per organization, in Bitcoin — are met by that time.

Has n0n’s breach of the 38 maritime firms been confirmed?
No. As of October 17, 2026, none of the 38 named organizations has publicly confirmed that its systems were compromised. SOCRadar explicitly cautions that the claims should be treated as unverified until data is published or a victim confirms. The October 19 deadline is expected to provide the first substantive test of what n0n actually holds.

Which shipping companies are named in the n0n leak list?
The named shipping lines and ship operators include Ocean Network Express (ONE) of Singapore, CULines of China, T.S. Lines of Taiwan, Polaris Shipping, Dong-A Tanker, Samjoo Maritime and Korea Ferry of South Korea, Camellia Line and Tsuneishi/Kambara Kisen of Japan, and Samudera of Indonesia. Terminal operators named include Santos Brasil, TTI Algeciras, Eurogate Tanger, BNCT and Pusan Newport Company.

How did n0n allegedly get the maritime data?
Researchers have a theory, not a confirmed answer. SOCRadar and Cydome suspect the 38 listings flow from one shared entry point — an exposed application or vulnerability in a port-community system, EDI integration or file-transfer product used by multiple organizations — rather than 38 separate network intrusions. The small, narrowly scoped datasets and recurring data types across victims support this theory, but it remains unverified.

Sources

• SOCRadar: n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site
• The Loadstar: Cyber-crime group hits 38 shipping and port groups with data leak threat
• Beinsure: n0n hackers demand up to $14 mn from 38 shipping and port firms in data breach
• Industrial Cyber: n0n extortion claims target 38 global maritime and logistics organizations, raising port data exposure concerns