A maritime cyber attack has placed 38 shipping, port and logistics organisations under threat of an alleged data leak. The n0n extortion group says it will publish the purportedly stolen information on 19 October 2026 unless ransom demands are met.
However, none of the named organisations had publicly confirmed a compromise as of 14 October 2026. The claims, affected systems and proposed route of access therefore remain unverified.
What happened in the maritime cyber attack?
On 12 October 2026, n0n added 38 organisations from the maritime ecosystem to its data leak site. The batch covers alleged victims in 18 countries and includes shipping lines, container carriers, ports and terminal operators, with a notable concentration of organisations in South Korea.
Named companies include Ocean Network Express, CULines, T.S. Lines and Samudera. Port and terminal organisations listed by the group include Santos Brasil, Portonave, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port and NEOM Ports.
The appearance of an organisation on a criminal leak site does not establish that a breach occurred. As of 14 October 2026, the maritime cyber attack claims had not been confirmed by the listed organisations, and no victim statement or authoritative technical advisory had validated n0n’s account.
SOCRadar reported that the ransom demands attached to the listings ranged from approximately US$2.4 million to US$14 million, payable in Bitcoin. It is unclear how the amounts were calculated or whether n0n had established direct contact with every listed organisation.
The threatened publication deadline
The listings contain a countdown to 19 October 2026 at 13:27 UTC. n0n claims it will release the data publicly if the targeted organisations do not pay before that time.
No publication from this batch had been confirmed by 14 October 2026. Reports of higher victim totals, including 42 or 50 listings, appear to relate to n0n’s wider cross-sector activity rather than contradicting the specific batch of 38 maritime organisations.
Maritime cyber attack timeline
- 12 October 2026: n0n posts 38 alleged maritime, port and logistics victims to its leak site.
- 13 October 2026: SOCRadar publishes an analysis of the listings, ransom demands and threatened publication date.
- 14 October 2026: Maritime trade publications report the claims while emphasising the absence of confirmation from the named organisations.
- 19 October 2026 at 13:27 UTC: The deadline stated by n0n for publication of the purportedly stolen information.
This compressed timeline is part of the pressure strategy. By listing many organisations simultaneously and attaching a public countdown, the group seeks to create reputational and commercial pressure before the allegations can be fully investigated.
What data does n0n claim to hold?
The n0n listings describe information closely connected to day-to-day shipping and terminal operations. The alleged material includes EDI messages, container manifests, vessel schedules, gate movement records, equipment interchange records and terminal configuration details.
The group also claims to possess commercial documents and employee account material. These descriptions have not been independently authenticated, and the age, completeness and origin of the alleged datasets are unknown.
EDI messages are used to exchange structured information between carriers, ports, terminals, freight forwarders and other supply chain participants. If the maritime cyber attack claims prove genuine, the data could reveal cargo movements, business relationships, operational timings or details about the systems through which partners exchange information.
That does not mean n0n has disrupted vessels, port machinery or operational technology. Current reporting concerns claimed data theft and extortion, not confirmed interference with navigation, cargo handling or terminal equipment.
How the n0n maritime cyber attack may have worked
n0n is assessed as a financially motivated data-theft extortion operation first observed in September 2026. Some reporting describes the group as stealing information and threatening publication without necessarily deploying ransomware that encrypts systems.
SOCRadar says n0n typically uses credentials harvested by infostealer malware to gain initial access. The group may then stage and exfiltrate accessible information before applying pressure through public leak listings. Early reporting also associates its activity with legitimate remote administration tools and Remote Desktop Protocol rather than sophisticated custom ransomware.
These are assessments of the group’s broader behaviour, not confirmed findings for each organisation in this maritime cyber attack. No victim has published a technical incident report establishing how n0n allegedly entered its environment.
Possibility of a shared environment
The simultaneous postings and apparently small, application-specific datasets have raised the possibility that one shared application or integration environment exposed information relating to multiple organisations. This could explain why 38 maritime entities appeared in a single batch without requiring 38 entirely separate intrusions.
A separate assessment cited in maritime reporting suggested a possible connection to a shared environment associated with a maritime software provider referred to as CLT. However, no primary vendor advisory has confirmed that suggestion, so it should be treated as an analytic hypothesis rather than an established cause.
No affected vendor product, software version or vulnerability has been formally identified. There is also no associated CVE, security patch or proof-of-concept exploit. Organisations should not infer that a particular platform is vulnerable solely from the structure of the leak-site claims.
Current exploitation and verification status
The extortion activity itself is visible in the wild because n0n has publicly posted the listings and deadline. What remains unverified is whether the group compromised all 38 organisations and whether the displayed descriptions accurately represent stolen data.
No authoritative indicators of compromise, such as malicious file hashes, attacker IP addresses, domains or file paths, had been released for this maritime cyber attack as of 14 October 2026. This limits the value of broad indicator matching and makes environment-specific investigation more important.
The lack of confirmation does not prove the claims are false. It means organisations should distinguish carefully between a public criminal allegation, evidence of data possession and a verified breach with an established technical cause.
Why the alleged data leak matters
Maritime data frequently passes between carriers, ports, software platforms, customs partners and logistics providers. A breach at one participant or shared service could therefore expose information about organisations that were not directly compromised.
UK freight forwarders, importers and smaller logistics businesses may have shipment or account data held in partners’ systems. If the maritime cyber attack is validated, downstream organisations could face fraudulent communications, convincing payment requests or phishing messages based on genuine commercial relationships.
What organisations should do now
- Check whether suppliers, carriers, terminals or platform providers used by the organisation appear among the listed entities.
- Ask relevant providers whether shared integrations, EDI connections or customer accounts are under investigation, without assuming a confirmed breach.
- Review remote access and application account activity for unusual logins, bulk downloads, unexpected exports or newly created administrator accounts.
- Reset exposed credentials where there is evidence of infostealer infection, credential reuse or suspicious remote access.
- Prepare to assess any data published after the stated deadline and identify employees, customers or shipments that may require a response.
Monitoring should remain evidence-led. Until a victim or vendor confirms the root cause, the priority is to investigate relevant connections, preserve logs and prepare for credible downstream notifications rather than making unsupported assumptions about a particular product.
Originally reported by The Maritime Executive.
