On 12 October 2026 the n0n extortion group added 38 organizations to its dark web leak site in a single posting. Nearly all of them work in ports, shipping or logistics. SOCRadar reports that the batch covers 18 countries: container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, and port IT providers in Kuwait, Indonesia and Germany. South Korea has the most entries, with 12. These are claims made by the criminals themselves. No listed organization has publicly confirmed a breach. No victim, regulator or national CERT has commented, and every source available for this brief is third-party threat-intelligence or aggregator reporting, so treat the figures below as attributed, not established.
What Happened
SOCRadar's 13 October analysis is the only detailed account of the maritime batch that we were able to review. A second outlet has also reported the postings, but we did not have its text for this brief, so the specifics here come from SOCRadar alone. SOCRadar describes the wave as follows:
- 38 organizations posted at once, more than doubling n0n's public victim count.
- South Korea accounts for 12 entries, including the Busan terminal operators BNCT and Pusan Newport Company.
- Publication deadline: 19 October 2026 at 13:27 UTC for all maritime entries.
- Demands in the listings SOCRadar reviewed range from USD 2.4 million to USD 14 million.
The batch is a sharp change of direction. n0n's earlier listings were spread across many sectors. ZeroFox says technology and professional services made up 46 percent of its targeting. SOCRadar's Chibitek profile and Security Arsenal both describe a group focused on technology, financial services and healthcare targets in the US, Canada, the UK and Australia. Its claimed victims included Transcom (a Netherlands-based customer support outsourcer), the Venezuelan ISP Inter, Irish cloud host Dediserve, MCAP / MortgageHub and Houston Thyroid & Endocrine Specialists.
Accounts of n0n's size before the wave don't match exactly. Fortra and ZeroFox both say the group had claimed about a dozen victims within days of its leak site appearing on 21 September. SOCRadar puts the total at 21 as of 8 October. Security Arsenal counted 13 recent listings in Canada, the US and Australia, published on 11 October. That was one day before the maritime batch, so the group was posting heavily in the days just before it.
Ocean Network Express cross-check: none of the reporting available for this brief names Ocean Network Express among the 38, and nothing in it links n0n to the earlier ONE incident. We did not have the full roster of 38, so we cannot rule out an overlap. Readers tracking ONE should treat any link as unestablished until the complete list or the companies themselves say otherwise.
What Was Taken
No volumes or record counts have been published for the maritime victims. SOCRadar describes the data sets as small and limited to specific applications, not the network-wide dumps n0n has claimed elsewhere. For comparison, the group's earlier claims were much larger, and all are also unverified:
- Transcom: 86.7 million support agent records from PayPal-related Citrix and authentication systems, plus an internal network map (per Fortra).
- Inter (Venezuela): more than 15.3 million subscriber connection records (per Fortra).
- Dediserve: a register of 167 tenant accounts, tenant server disk images, and access to an operations mailbox. The group also claims that all 46 FRA1 servers and their backups were wiped (per Revenanas).
How severe the maritime claims are depends on which applications were exposed. A shared terminal or port community system would hold booking, cargo, customs and partner data rather than whole corporate networks.
Why It Matters
SOCRadar's main point is about structure, not the number of victims. Small data sets that only cover certain applications, together with patchy infostealer coverage across the listed companies, suggest one exposed shared application or vulnerability rather than 38 separate break-ins. If that is right, the real risk is a supply chain one. A single compromised port IT provider or shared platform could expose terminals, shipping lines and freight forwarders in several countries at once. Organizations that use the same supplier could be affected without being on the list.
Researchers also disagree about what n0n is. CyberXTron calls it double-extortion ransomware. SOCRadar says it is pure data theft and extortion. n0n itself claims to shut down networks and destroy backups and shadow copies. Fortra says those claims deserve "a pinch of salt", and ZeroFox says it is unclear whether n0n can actually reach victims' backups. Port operators need to know which of these is true, because one is a data-exposure problem and the other a disruption problem.
The Attack Technique
Sources describe two different routes in, and they may not contradict each other:
- Stolen credentials (earlier victims): Fortra and ZeroFox both say n0n uses valid credentials collected by infostealer malware. It then moves around networks with legitimate admin tools and RDP and escalates privileges before staging data. Neither describes it exploiting unusual vulnerabilities.
- A shared entry point (maritime wave): SOCRadar thinks a common application or vulnerability is more likely for this batch. It points out that infostealer logs don't cover all the victims, so stolen credentials alone don't explain the pattern. SOCRadar also notes for Chibitek that finding no stealer-log records does not prove no compromise took place.
Security Arsenal has listed CISA KEV entries for VMware vCenter, JetBrains TeamCity, Cisco FMC, Check Point Security Gateway and Nx Console. It describes these explicitly as sector-level hypotheses, not confirmed entry points for any listing. SOCRadar assesses the group as likely Russia-based. No other source in this set confirms that attribution.
What Organizations Should Do
- Map shared maritime platforms now. List every port community system, terminal operating system, booking portal and third-party port IT provider you connect to. Ask those suppliers directly whether they are investigating.
- Hunt for infostealer exposure. Check stealer-log feeds for corporate domains and staff personal email aliases. Rotate credentials and force MFA on VPN, RDP, Citrix and web-facing admin portals.
- Watch for staging and exfiltration. Look for unusual archive creation, large outbound uploads, and admin tools or RDP used outside normal patterns, particularly on accounts linked to shared applications.
- Make backups tamper-resistant. n0n says it targets backups and shadow copies. Make sure offline or immutable copies exist and that a restore has been tested.
- Prepare for 19 October. Monitor the leak site around the 13:27 UTC deadline. Check any published data against your own systems, and agree in advance who talks to partners, customs authorities and regulators.
- Don't treat silence as proof. Being listed doesn't confirm a breach, and not being listed doesn't rule out exposure through a shared supplier.
Sources: n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site | n0n Ransomware: What You Need to Know Fortra | N0N Leak-Site Claims: 13 Organizations Listed Across CA/US/AU — Sec... | N0n Ransomware Group Claims New California Target, Warns of Data Ex... | Chibitek Data Breach Business Services | Ransomware group n0n claims breach of Dediserve Ltd cloud infrastru... | N0N Ransomware Gang: 4 Leak-Site Listings Across Tech, Finance & He... | Flash Report: Emerging Threat Actor Targets Data Backups ZeroFox