On 12 October 2026, the extortion group n0n listed 38 maritime organisations from 18 countries on its dark-web leak site, all in one batch. The list covers shipping lines, container terminals, port IT providers, logistics firms, ship managers and agents. Two research firms, SOCRadar and Cydome, have each concluded that the data probably came from one shared environment rather than from 38 separate intrusions. Cydome's interim analysis links that environment to CyberLogitec (CLT), a South Korean provider of maritime software and IT services. As of the latest reporting, none of the named organisations had publicly confirmed a breach, and none of the sources includes a statement from CyberLogitec. Several maritime trade outlets have reported that many companies were hit at once. However, every source on this incident is secondary, and no victim statement, regulator filing or CERT advisory has confirmed the attack.
What Happened
The listings. n0n published the listings on 12 October. Each one carries a countdown to a leak deadline of 19 October 2026, 13:27 UTC (Hellenic Shipping News citing Cydome; Cypro). The Loadstar, citing SOCRadar, reports that South Korea accounted for 12 listings.
Named organisations. Across the reports, these include:
- Shipping lines: Ocean Network Express (ONE), CULines, T.S. Lines, Samudera and Polaris Shipping
- Ports and terminals: BNCT and Pusan Newport Co. in Busan, Brazil's Santos Brasil, Portonave and Superterminais, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port and NEOM Ports
- Others: Indonesia's ILCS Pelindo, South Korean logistics firm EUSU and Chinese crane maker ZPMC (Beinsure)
Victim count. Accounts differ. Cydome's first warning on 14 October, reported by World Ports Organization and Digital Ship, put the figure at 37 organisations, about 27% of them shipping companies and mostly based in Asia-Pacific. SOCRadar, The Loadstar, Cypro, Beinsure and Cydome's own later analysis of 18 October all give 38. Cypro notes that higher totals in circulation, such as 42 or 50, appear to reflect n0n's wider activity across other sectors, not this batch.
About n0n. The Loadstar reports that the group emerged in September 2026 and had previously listed 21 organisations in telecoms, retail, pharmaceuticals and education. This one batch more than doubled its known victim count.
What Was Taken
Data types. SOCRadar reviewed the published samples and described:
- Electronic data interchange (EDI) messages
- Container and shipping manifests
- Vessel schedules
- Gate movements and equipment interchange records
- Terminal system configuration records
Volumes. n0n's claimed volumes per victim range from 60 MB (EUSU) to 2.4 GB (ILCS Pelindo), according to The Loadstar. Cydome counts 85 sample files published by n0n.
Ransom demands. The reported figures conflict sharply:
- SOCRadar, cited by Cypro and Beinsure, puts the demands at roughly US$2.4M to US$14M per company, payable in Bitcoin. It says the amounts are scaled to the volume of data claimed and that some may be negotiable.
- Cydome, cited by Hellenic Shipping News, gives a range of US$400,000 to US$400M.
Neither figure has been independently verified. Cypro notes that it is unclear how the amounts were calculated, or whether n0n has contacted every listed organisation directly.
What this means for exposure. Because none of the victims has confirmed a breach, the existence, scope and authenticity of the data are unverified. The datasets are small and narrowly focused. That fits operational and commercial data taken from a support or integration archive, not a full network compromise. Even so, terminal configuration records and EDI data are sensitive in operational terms.
Why It Matters
The intrusion count is probably wrong. If the shared-vendor theory holds, this is one supplier compromise that n0n has repackaged as 38 separate extortion cases. Cydome's interim view is that n0n "split the data into separate 'victims' parts and set an individual ransom demand for each customer." Cydome stresses that this is not confirmed.
Vendor data is now leverage against clients. A supplier's support or project archive holds data for many clients at once. A single breach there gives an extortion group pressure points across a whole sector, without the group ever entering those clients' own networks.
The exposure is uneven. For defenders, the more pressing issue is what each organisation shared with CLT, or with any common integration platform, and what access its support staff still hold. Terminal configuration records and EDI integration details are useful for further intrusions as well as for extortion.
Unrelated items in the source set. Two of the eight sources do not relate to this incident, and nothing in the reporting connects either one to it:
- Wärtsilä advisory: CISA advisory ICSA-26-258-02 (15 September 2026) covers hard-coded cryptographic keys in Wärtsilä FOS-Onboard 5.07.0923.01 (CVE-2026-78225 and CVE-2026-81855, CVSS v3.1 8.3). It is relevant to maritime supply-chain risk in general.
- Mitsui Ocean Cruises: The company's 10 September 2026 notice reports a lost external storage device that may hold guest and crew data.
Treat both as separate matters.
The Attack Technique
The initial access vector has not been confirmed. Researchers point to three pieces of evidence:
- Common customer base: Cydome says at least 21 of the 38 listed companies are publicly documented CyberLogitec customers, and that other details in the samples also point to CLT. Its working theory is that the data came from a support and project archive that originated at, or is linked to, CyberLogitec.
- Common document types: SOCRadar points to the small, narrowly scoped datasets and the recurring document types. These suggest data taken from an application or integration platform that many organisations use.
- Missing credential trail: SOCRadar notes that many listed companies have no matching infostealer credential records. n0n's usual method is to break in with employees' stolen credentials, and that would normally leave such records behind, so separate per-company intrusions look less likely.
Both firms frame their conclusions as assessments, not findings. The source of the alleged breach and the extent of the exposure remain unconfirmed.
What Organizations Should Do
- Inventory vendor-held data. Find out what operational, commercial and configuration data you have shared with CyberLogitec, or with any shared maritime software or EDI platform, including support tickets and project files.
- Rotate support credentials. Rotate credentials, API keys and integration secrets that vendor support staff use or that are stored in shared environments. Review and cut back remote-support access paths.
- Assume configuration data is exposed. If terminal or system configuration records may have leaked, check those systems for changes and harden anything that the leaked data could help an attacker target.
- Prepare for the leak. Ready legal, communications and threat-intelligence teams to assess any n0n publication after the 19 October deadline. Check whether the data is authentic before engaging, and coordinate with your national CERT and law enforcement.
- Watch for follow-on fraud. Leaked manifests, schedules and EDI flows can feed invoice fraud, cargo theft and spear-phishing. Brief finance and operations teams.
- Patch shipboard systems. Wärtsilä FOS-Onboard users should apply patch 5.08.4052.01 to address CVE-2026-78225 and CVE-2026-81855. This is general maritime hygiene, not related to the n0n incident.
Sources: nOn Cyber Extortion Incident Involving 38 Maritime Companies Likely... | Wärtsilä FOS-Onboard (Update A) CISA | Cydome warns of alleged CyberLogitec breach affecting 37 maritime o... | Cydome warns of alleged CyberLogitec breach affecting 37 maritime o... | Cyber-crime group hits 38 shipping and port ... | Maritime Cyber Attack: 38 Firms Face Leak | n0n hackers demand up to $14 mn from 38 shipping and ... | Loss of External Storage Device Containing Business Information【公式】...