The N0n ransomware claim naming “BMT IQ (marine surveying and inspection)” became public on 12 October 2026. The newly emerged extortion group alleges that invoicing and equipment receipt data was exposed, but there is no independent confirmation of a breach.
The listing is notable for its limited evidence and uncertain identification of the alleged victim. As of 12 October 2026, no data samples, screenshots, forensic findings or public statement from the named organisation have corroborated the claim.
What the N0n ransomware claim alleges
On or before 12 October 2026, N0n added an entry for “BMT IQ (marine surveying and inspection)” to its dark web leak site. Public ransomware trackers detected the entry and included it in their summaries of newly disclosed victims that day.
The post described the incident as an exposure of data and marked the alleged victim as “not paid”. It identified commercial e-invoice records and equipment interchange receipts as the supposed data categories. These records could contain commercially sensitive details about transactions, cargo movements, equipment transfers or business partners, although no examples were provided.
Crucially, the N0n ransomware claim did not state that systems had been encrypted. It also contained no ransom demand, financial amount, data volume, hostnames, file paths or technical explanation showing how the alleged access occurred.
The listing reportedly scheduled publication of the alleged data for 19 October 2026 at 13:27 UTC. That time had not been reached when the claim was reported on 12 October, and there was no independently verified evidence that N0n possessed the material it described.
Evidence included in the listing
The public information attached to the allegation was extremely limited. In particular, the listing provided none of the evidence often used to assess the credibility and scope of an extortion claim:
- No screenshots of internal systems or documents.
- No downloadable samples or file directory listings.
- No estimate of the number or size of allegedly stolen files.
- No ransom amount, payment address or negotiation details.
- No indicators of compromise, such as domains, IP addresses or file hashes.
This means the appearance of the entry on multiple trackers confirms that a leak-site listing existed. It does not independently confirm that an intrusion, data theft or ransomware incident took place.
N0n ransomware claim timeline and status
N0n is a recent entrant to the data-extortion landscape. Leak-site monitors first observed listings associated with the group on 18 September 2026, less than a month before the BMT IQ allegation appeared.
- 18 September 2026: The first observed N0n victim listings appear on leak-site monitoring services.
- 12 October 2026: Trackers record “BMT IQ (marine surveying and inspection)” as a newly listed alleged victim.
- 19 October 2026 at 13:27 UTC: The time reportedly set by N0n for publication of the alleged data.
As of 12 October 2026, the exploitation status remains unconfirmed. There is no third-party digital forensics evidence linking N0n to the organisation, no confirmed release of files and no reported operational disruption.
Two third-party trackers recorded the entry, but both reflect information taken from the threat actor’s leak site. Their records corroborate the existence and timing of the N0n ransomware claim, not the truth of the underlying allegation.
Uncertainty over which BMT IQ was named
The identity of the intended target is also unclear. BMT Group is a UK-headquartered consultancy with operations covering maritime services and marine surveying. Separately, BMTIQ is the Basra Multipurpose Terminal, an Iraqi port terminal operator.
The wording “BMT IQ” combined with the tracker description “marine surveying and inspection” could point towards a BMT marine consultancy operation. However, the similar name used by the Iraqi terminal creates a realistic possibility of mislabelling by the actor, automated trackers or both.
No evidence published with the N0n ransomware claim resolves this ambiguity. Until documents, technical artefacts or a formal organisational statement emerge, it is not possible to determine which entity was intended or whether either organisation was actually compromised.
How N0n reportedly conducts data extortion
Open-source analysis describes N0n primarily as a data-theft and extortion operation rather than a group consistently demonstrating file encryption. General reporting says its typical approach may involve credentials harvested by infostealer malware, remote services such as Remote Desktop Protocol and legitimate administrative tools already present within a network.
Once access is obtained, an extortion actor can search for valuable business files, stage them in a central location and transfer them outside the organisation. The stolen information is then used to pressure the victim, often through a threatened leak deadline. Some reporting on N0n also notes rhetoric about destroying backups.
None of those techniques has been evidenced in the BMT IQ case. No initial access method, compromised account, malware family, remote access session or exfiltration channel has been identified. There is also no proof that backups were accessed or damaged.
No affected products or versions identified
The N0n ransomware claim does not identify any exploited software product, hardware platform, version or configuration. There is consequently no vendor patch or vulnerability advisory directly associated with this event, and no case-specific proof of concept or attacker tooling has been released.
Organisations should therefore avoid interpreting the listing as evidence of a new vulnerability affecting maritime or surveying technology. At present, it is an unsupported data-exposure allegation rather than a technically documented software exploit.
Why the unverified claim still matters
Even an unverified leak-site accusation can create reputational and operational pressure. Customers, suppliers and staff may encounter copied claims through monitoring services or social media before the named organisation has established whether the allegation is genuine.
N0n’s short operating history adds to the uncertainty. Industry assessments advise treating its postings cautiously, particularly because new extortion brands can exaggerate access, reuse old information or name organisations without adequate proof.
Responding to the N0n ransomware claim
Any organisation that may be connected to this listing should first establish whether the name refers to its legal entity, brand or infrastructure. Investigation should focus on the specific information categories mentioned and the period immediately preceding the 12 October disclosure.
- Review access to repositories containing e-invoices and equipment interchange receipts.
- Preserve authentication, remote access, file access and outbound transfer logs for investigation.
- Check for unusual account activity, bulk document access or unexpected data staging.
- Monitor the stated 19 October publication time without accessing or distributing stolen material.
- Prepare factual communications that distinguish a criminal allegation from a confirmed incident.
- Watch for phishing, impersonation or secondary extortion attempts referring to the listing.
The current evidence supports only one firm conclusion: N0n published an allegation on 12 October 2026. Whether any compromise occurred, what data may be involved and which organisation was intended all remain unresolved.
Originally reported by redpacketsecurity.com.
