The extortion group N0n has listed Tsuneishi / Kambara Kisen, a major Japanese shipbuilding and ship management group, on its dark web leak site. N0n says it stole "operational EDI archives and commercial contract records" and has set a publication deadline of October 19, 2026, at 13:27 UTC. The claim is unverified. The company has made no public statement. No regulator, CERT or vendor has commented. All seven sources for this brief are trackers, aggregators or threat intelligence blogs, and they all go back to the same leak site post. Ransomware.live, which first logged the listing, notes that N0n "is an emerging group, so this claim should be treated with caution until independently verified." HackerFeeds and Nightwatch say the same: they have not checked the claim themselves.
What Happened
- The listing: Ransomware.live logged the Tsuneishi / Kambara Kisen entry on October 12, 2026, at 14:12 UTC. It gives the same date as the estimated attack date. QPulse, HackerFeeds, Breaches Live and Nightwatch all repeat the Ransomware.live record.
- The leak post text: "Shipbuilding / ship management · Japan | Operational EDI archives and commercial contract records | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]." The "NOT PAID" tag is N0n's own statement and says nothing reliable about whether the two sides are negotiating. HackerFeeds reports that the onion URL for the post points to the domain tsuneishi.com.
- Part of a larger maritime wave: SOCRadar reports that on October 12, N0n posted 38 organizations to its leak site in one batch. Nearly all were port, shipping and logistics operators, across 18 countries. South Korea accounted for 12 of them, including the Busan terminal operators BNCT and Pusan Newport Company. SOCRadar gives October 19, 2026, at 13:27 UTC as the publication deadline for the maritime entries, which is exactly the Tsuneishi deadline. The SOCRadar excerpt we reviewed does not name Tsuneishi, so its inclusion in that batch is an inference from the matching date and timing, not a confirmed fact.
- How serious it is: Accounts differ. QPulse rates the incident "High" (75/100). HackerFeeds rates it "MEDIUM." Neither explains its method.
- Ransom amount: None of the sources gives a demand for Tsuneishi. SOCRadar says the maritime demands it reviewed ranged from USD 2.4 million to USD 14 million.
What Was Taken
The only description of the data comes from N0n itself: operational EDI archives and commercial contract records. No source gives a file count, data volume or sample contents. Ransomware.live has a leak screenshot field, but our source excerpt did not include its contents.
Brinztech goes further than the leak post. It says the EDI files cover "automated supply chain transactions, port logistics schedules, and material orders" and that the contracts include "engineering specifications." The leak post text repeated by every other source does not mention engineering specifications. Treat that detail as Brinztech's own reading, not part of the actor's claim.
If the files are real, they matter because EDI archives record transactions with other companies. They could expose purchase orders, pricing, delivery schedules and partner identities for Tsuneishi's suppliers, shipowners and port contacts, not just Tsuneishi's own data.
Why It Matters
- A new actor focusing on maritime: SOCRadar describes N0n as a financially motivated data-theft extortion group, likely Russia-based, first seen in September 2026. It says N0n has moved from opportunistic, cross-sector targeting to a clear focus on maritime.
- Victim counts differ: SOCRadar reports 21 victims before the maritime wave, as of October 8, plus 38 posted on October 12, for about 59. Breaches Live, citing Ransomware.live, says 76 victims in total. The gap may come from different counting dates, or from postings after SOCRadar's snapshot. Either way, N0n has posted dozens of victims in about a month.
- Supply chain spillover: Shipbuilding sits at the centre of a dense network of steel suppliers, equipment vendors, classification societies, shipowners and financiers. Exposed contracts and EDI records could be used for follow-on fraud against partners, such as business email compromise or fake invoices, even if Tsuneishi's own operations are unaffected.
- No confirmation yet: None of the maritime victims had publicly confirmed a breach when SOCRadar published. New groups sometimes inflate claims or recycle old data, so defenders should prepare without treating the leak as fact.
The Attack Technique
N0n has not said how it got in, and Tsuneishi has said nothing. The best available evidence is indirect:
- Possible shared entry point: SOCRadar argues that the 38 maritime listings may not be 38 separate intrusions. It points to small data sets limited to a single application, and to infostealer infections found at only some victims. Together, those suggest a shared exposed application or vulnerability, possibly a common port, logistics or EDI platform. If so, the Tsuneishi "EDI archives" might come from a third-party system rather than Tsuneishi's own network. That is a hypothesis, not a finding.
- Encryption, or theft only? Accounts differ. Brinztech calls N0n a "double-extortion cartel" that encrypts files and also threatens leaks. SOCRadar classes it as a data-theft extortion group. Nothing in the sources shows systems were encrypted at Tsuneishi.
- Infostealers: SOCRadar's mention of partial infostealer coverage across victims means stolen credentials may have played a role in some intrusions.
What Organizations Should Do
- Audit EDI and B2B integration platforms now. Shipbuilders, shipping lines and port operators should list every third-party EDI, port community or logistics SaaS connection they use. Check vendor advisories, and review access logs from September 2026 onward for unusual bulk exports or API pulls.
- Hunt for staging and exfiltration around October 12. Look for archive creation, large outbound transfers, and access to contract repositories or EDI message stores from unusual accounts, hosts or locations, as QPulse advises.
- Reset credentials exposed to infostealers. Check infostealer log feeds for employee and vendor credentials tied to integration portals and VPNs. Rotate those passwords and API keys, and enforce phishing-resistant MFA on partner-facing systems.
- Prepare partners for fraud. If you trade with Tsuneishi / Kambara Kisen or any listed maritime firm, assume order, pricing and banking details could be exposed. Verify any change to payment or delivery instructions through a known channel before acting.
- Watch the October 19 deadline. Monitor the N0n leak site through a threat intelligence provider, not by browsing directly. Have legal, communications and procurement teams ready to judge quickly whether any published data is real.
- Limit what integration systems keep. Cut how long EDI archives and contract files are stored on internet-facing integration systems. Old transaction history kept on middleware gives attackers more to steal.
Sources: Ransomware Group N0n Claims Attack on Tsuneishi / Kambara Kisen QP... | N0n Ransomware Syndicate Extorts Major Japanese Shipbuilder Tsuneis... | n0n Group Puts Dozens of Global Ports and Shipping on Its ... | Ransomware group N0n hits Tsuneishi / Kambara Kisen (shipbuilding a... | Victim: Tsuneishi / Kambara Kisen (shipbuilding and ship ... | Tsuneishi / Kambara Kisen (shipbuilding and ship management) attaqu... | 🏴☠️ N0n has just published a new victim : Tsuneishi / Kambara Kise...