On 12 October 2026, the data extortion group n0n listed a single batch of shipping lines, port authorities, terminal operators and maritime service firms on its dark web leak site. Each was given a payment deadline of 19 October. Reported victim counts vary: Cydome's first warning on 14 October counted 37 organisations (Digital Ship), SOCRadar and Cydome's later analysis counted 38 across 18 countries (The Loadstar, World Ports Organization, Hellenic Shipping News), and Risky Bulletin describes "40+". Two security firms have independently concluded that the listings probably trace back to one compromised supplier rather than dozens of separate intrusions. Cydome names CyberLogitec, a South Korean maritime IT provider, as the likely source. No victim, CyberLogitec, regulator or national CERT had publicly confirmed a breach in any of the sources reviewed, so every detail here rests on security vendor analysis and the attacker's own claims.
What Happened
n0n appeared in mid-September 2026. Before the maritime batch, SOCRadar had recorded 21 victims across 17 countries in telecoms, retail, pharmaceuticals, education and investment (The Loadstar, World Ports Organization). The 12 October listings more than doubled that count. Risky Bulletin reports that the leak site now lists more than 140 victims in total and estimates that this pace would have made n0n the third most active extortion group of Q3, behind Qilin and The Gentlemen.
Named organisations reported across the sources include:
- Shipping lines: Ocean Network Express (ONE, Singapore), CULines (China), TS Lines (Taiwan), Polaris Shipping (South Korea)
- South Korean terminals and logistics: BNCT and Pusan Newport Co. in Busan, and logistics firm EUSU. South Korea accounted for 12 listings (The Loadstar).
- Ports and terminals elsewhere: Santos Brasil, Portonave and Superterminais (Brazil), TTI Algeciras (Spain), Eurogate Tanger (Morocco), ILCS Pelindo (Indonesia), plus sites in India, Saudi Arabia, Vietnam and Japan
- Adjacent industry: Chinese crane manufacturer ZPMC (World Ports Organization)
Cydome said about 27% of its initial 37 (10 organisations) were shipping companies, and that most were in Asia-Pacific (Digital Ship).
Reported ransom figures also differ:
- SOCRadar puts individual demands at $2.4M to $14M, scaled to the claimed data volume, with signs that n0n will negotiate (World Ports Organization).
- Cydome reports per-company demands from $400K to $400M, nearly all with the same deadline of 19 October 2026, 13:27 UTC (Hellenic Shipping News).
- Risky Bulletin, citing the leak site listings, puts the combined demand at about $1.2 billion and says most victims refused to pay and have had data published.
None of these figures has been independently verified.
What Was Taken
SOCRadar reviewed n0n's published samples and found operational and commercial maritime data rather than broad corporate file dumps. The samples included:
- Electronic data interchange (EDI) messages
- Container manifests
- Vessel schedules
- Gate movement records
- Terminal system configuration records
Claimed volumes per victim were small, from 60MB for EUSU to 2.4GB for ILCS Pelindo (The Loadstar). Cydome analysed 85 sample files and said it "cannot validate" the data's authenticity. Its interim view is that the material probably comes from one support and project archive held at, or linked to, CyberLogitec, which n0n split up by customer (Hellenic Shipping News). On this reading, the exposure for each victim is whatever that customer had in the vendor's support environment, not necessarily anything from its own network. Cydome says plainly that it does not know which system was accessed, how, or how much data was taken per customer.
Terminal configuration records are the most sensitive item listed. For an attacker planning a follow-on operation, they are more useful than commercial data.
Why It Matters
Risky Bulletin calls this one of the largest cyber incidents in the maritime sector since NotPetya. That event's lesson was the same one this incident points to: a single shared dependency can expose a whole sector at once. It also fits a wider pattern of logistics providers being the weak link in 2026:
- CEVA Logistics: an intrusion beginning 29 July disrupted eight European warehouses. Downstream, bol suspended data exchanges and ING, Valve and AFC Ajax warned customers about exposed delivery data (teiss).
- ShipMonk: a breach at Trezor's fulfilment partner exposed 80,689 customers. That figure grew from an initial 11,742 full and 1,947 partial exposures after historical data Trezor had been told was deleted turned out to still exist (Coinlive, citing Trezor's notice).
- Shipping Association of New York and New Jersey: data was stolen on 27 May and Qilin claimed the attack. Notification letters only began going out on 2 October (Edelson Lechtzin LLP release).
None of these three incidents is linked to n0n. They show the same exposure, though: data held by a supplier is your data, and the supplier's retention and access practices become your risk. n0n's approach of turning one vendor breach into dozens of separate extortion demands is cheap for the attacker, and that makes it likely to be copied.
The Attack Technique
The initial access vector is unconfirmed. The supply chain theory rests on circumstantial evidence:
- Customer overlap. Cydome found that at least 21 of the 38 listed firms are publicly documented CyberLogitec customers (Hellenic Shipping News). Risky Bulletin describes this as "half". Other details in the sample files also point to CyberLogitec.
- Vendor downtime. Risky Bulletin reports that CyberLogitec's website has been down for weeks.
- Data shape. SOCRadar said the small, narrowly focused datasets and recurring document types fit theft from a shared application or integration platform used by many organisations (The Loadstar).
- No infostealer trail. SOCRadar notes that n0n usually gets in with stolen employee credentials, but found no matching infostealer records for many of the listed companies. That argues against 38 separate credential-based intrusions.
World Ports Organization, citing SOCRadar, says n0n avoids building traditional ransomware and focuses on data theft and extortion, and that the group is "likely" based in Russia. That attribution is SOCRadar's assessment and has not been independently confirmed. CyberLogitec has not issued a public statement in any of the sources reviewed.
What Organizations Should Do
- Ask CyberLogitec directly. If you are a customer, request written confirmation of whether your data sat in any support, project or ticketing archive, and what it contained. Do not wait for your name to appear on a leak site.
- Rotate credentials suppliers hold. Change all passwords, API keys, VPN accounts and EDI integration credentials used by vendor support teams. Treat any configuration data shared with a vendor as exposed.
- Review terminal and OT configurations. If configuration records may have leaked, check for exposed hostnames, IP ranges, service accounts and default credentials, and harden them before someone uses that information.
- Enforce data minimisation in contracts. The ShipMonk case shows vendors keep data long after they say it has been deleted. Require retention limits for support archives and evidence of deletion, and audit them.
- Map shared-platform dependencies. List every SaaS, EDI and integration provider that holds your operational data or has access to your environment, and limit that access to scoped, monitored, time-bound connections.
- Prepare your disclosure position now. Leaked EDI and manifest data may trigger notification duties to customers, partners and regulators. Line up legal, communications and incident response before the data surfaces publicly.
Sources: Supply chain attack lets ransomware group inside 40+ shipping compa... | Cydome warns of alleged CyberLogitec breach affecting 37 maritime o... | Cyber-crime group hits 38 shipping and port groups with data leak t... | Massive Cyber Attack Threatens Release of Data from 38 Maritime Com... | nOn Cyber Extortion Incident Involving 38 Maritime Companies Likely... | teiss - News - CEVA cyber-attack shows how provider disruption spreads | Shipping Association of New York and New Jersey Data Breach | Trezor: Shipping Breach Exposed 80,689 Customers’ Details