The N0n ransomware group has listed Ocean Network Express (ONE), the Singapore-based container shipping line, on its leak site and says it has published data stolen from the company. Leak-site trackers that index ransomware.live data list the incident as "NOT PAID" and say files have been released. That goes further than a bare listing, but nobody has independently checked the files. Ocean Network Express has made no public statement, and none of the eight sources behind this brief is a primary disclosure, a regulator filing, a national CERT advisory or an established security outlet. Every account of the incident comes from aggregators that repeat what the threat actor posted. Readers should treat the details of the theft as the attacker's claim, not established fact. The same group also listed a Busan port-community IT provider on the same day, which suggests N0n may be working through the maritime sector.
What Happened
Two tracker sites agree that N0n listed Ocean Network Express on October 12, 2026. Cyber Threat Intelligence (cyberthreatintelligence.net) records that date as the leak-site listing and notes that it can differ from when the compromise actually happened. QPulse (quasarcybertech.com) reports the same listing and says the victim did not pay.
The timeline does not fully hold together. QPulse says the files were published on 2026-10-19 at 13:27 UTC, which is a week after the listing and after this brief's publication date. That timestamp may be a scheduled release countdown copied from the leak site, a data-entry error, or a time-zone or format problem. We cannot confirm from the available sources that the full dataset is live yet. The listing is confirmed. The release of the full dataset may still be pending.
Figures about the group's track record also conflict. One sentence in the Cyber Threat Intelligence record says N0n has 89 victims in its database, and another sentence in the same record says it has listed 9 victims since September 2026. The difference could come from counting periods or from bad data. Either way, N0n's real size and history are uncertain.
The same tracker data puts ONE in the context of Singapore ranking 16th worldwide for ransomware disclosures, with 188 recorded victims.
What Was Taken
QPulse says the leaked material includes:
- Internal staff directories
- Operational voyage and fuel-consumption records
- Financial-adjacent planning material
No source gives a file count, a data volume, or any sign that customer data, shipment manifests or employee personal records such as HR or payroll files are included. QPulse states that it indexes only what ransomware operators post publicly and has not seen the stolen content. The list of data types is therefore N0n's own description, passed on by an aggregator.
Context on the company's size, so the staff-directory claim can be judged, also varies by source. ONE's LinkedIn company page (S4) lists 6,067 employees across 67 countries and US$16.6B in annual revenue. The company summary attached to individual employee profiles on the same platform (S5, S8) gives 3,000 to 4,000 employees across 69 countries and US$4B to $5B in revenue. Both are third-party estimates, so a leaked staff directory could hold somewhere between a few thousand and more than six thousand entries. The company's own About section describes a fleet of more than 280 vessels with about 2.2 million TEU of capacity, running more than 165 services to 120 countries.
Why It Matters
Staff directories are a social-engineering toolkit. A real internal directory gives attackers names, roles, reporting lines and contact details for a global workforce. Public professional profiles already show ONE staff in legal, cargo claims, infrastructure and IT roles in several countries. A leaked directory would let attackers check that information and fill in the gaps, which raises the risk of convincing phishing, business email compromise (BEC) and fake helpdesk calls aimed at IT and finance staff. ONE customers and freight partners should also expect phishing that impersonates the company.
Operational data has competitive and security value. Voyage and fuel-consumption records show route economics, speed and slow-steaming choices, and efficiency performance. Financial planning material could reveal commercial strategy. For a carrier of ONE's size, that is commercially sensitive even if no personal data is involved.
The maritime sector looks like it is under pressure. On the same day as the ONE listing, ThreatMon reported (via Undercode News) that N0n had also listed GNCNet / DGT Busan, a port-community IT organisation. Separately:
- The Qilin ransomware group claimed an attack on the Shipping Association of New York and New Jersey. The Association confirmed that an unauthorized actor took files on May 27, 2026 and began sending breach notices on October 2.
- US investigators have said that hackers reached a system linked to the propulsion of the oil tanker VL Prosperity off Texas in August. The FBI and US Coast Guard are still investigating, and no attribution has been made.
There is no evidence linking these incidents to each other or to the ONE listing. Taken together, they show sustained hostile activity across carriers, port platforms, industry associations and vessels. Port-community systems such as GNCNet connect carriers, terminals and forwarders, so a breach at one node can expose data from its partners.
The Attack Technique
Unknown. No source identifies how N0n got in, how long it was inside, or how it took the data out. ONE has not said whether any systems were encrypted or whether operations were affected, and there are no reports of service disruption.
Cyber Threat Intelligence describes N0n's general model as double extortion: steal data first, then encrypt, then threaten to publish. The "NOT PAID" status and the move toward publication fit that pattern. Whether ONE's systems were actually encrypted is not reported.
Without incident-specific indicators, defenders should assume the access methods usually seen in ransomware intrusions against large, distributed enterprises: stolen or brute-forced credentials on VPN and remote access, unpatched edge devices, and phishing. These are general assumptions, not findings from this case.
What Organizations Should Do
- Prepare for targeted phishing right away. ONE staff, partners and customers should expect phishing and BEC built from the leaked directory. Warn finance, claims and IT helpdesk teams in particular, and require out-of-band checks for payment changes and credential resets.
- Tighten identity controls on remote access. Enforce phishing-resistant MFA on VPN, VDI/Citrix and administrative portals. Review recent authentication logs for impossible travel, new MFA device enrolments and dormant accounts that have become active again.
- Watch for large outbound transfers. Alert on bulk outbound transfers to cloud storage and file-sharing services, and on archiving tools such as rclone, WinSCP and 7-Zip running on servers. Data theft usually happens days or weeks before the leak-site listing.
- Separate operational and planning data. Voyage, fuel and financial planning systems should not be reachable from general corporate user segments. Apply least privilege and log access to them.
- Review third-party and port-community connections. Organisations connected to GNCNet / DGT Busan or similar platforms should list their integrations, rotate shared credentials and API keys, and ask providers for a compromise assessment.
- Keep IT and OT incident plans separate. Given the VL Prosperity case, carriers and ship managers should confirm that vessel OT networks are segmented from shore IT and satellite links, and that crews have a clear procedure to follow when communications are lost.
Sources: N0n Ransomware Group Publishes Stolen Data from Ocean Network Expre... | Ocean Network Express (container shipping) Ransomware Attack by N0n... | N0n Ransomware Group Adds GNCNet / DGT Busan to Its Victim List in... | Ocean Network Express | Christine C. | Shipping Association of New York and New Jersey Data Breach Investi... | Hackers Access Oil Tanker Propulsion System Near Texas, U.S. Invest... | Martijn S.