n0n Extortion Group Claims 38 Maritime and Logistics Firms in New Leak Campaign
The n0n threat actor has listed 38 global maritime and logistics organizations on its dark web site, demanding millions in ransom for port data.
Key points
- The n0n group claims to have stolen data from 38 organizations across 18 countries in the maritime sector.
- Settlement demands range from $2.4 million to $14 million, with a publication deadline set for October 2026.
- Analysis suggests a shared entry point rather than 38 separate intrusions due to similar data sets.
The n0n extortion group has added 38 organizations from the global maritime and logistics sectors to its dark web leak site, according to a report by SOCRadar. The listings span 18 countries and include container terminals, shipping lines, port IT providers, and related logistics businesses. South Korea accounts for 12 of the 38 entries, including major terminal operators BNCT and Pusan Newport Company.
SOCRadar reported that the stolen data reportedly includes vessel schedules, container manifests, gate movement records, shipping documentation, and terminal system configuration files. The n0n group set a publication deadline of October 19, 2026, at 13:27 UTC. Settlement demands reviewed by SOCRadar ranged from $2.4 million to $14 million. None of the listed maritime organizations had publicly confirmed the claims at the time of the report.
Context and Technical Analysis
SOCRadar noted that the pattern of relatively small, narrowly scoped data sets points to a possible shared application or vulnerability. The lack of infostealer credential matches for many listed organizations suggests a single entry point rather than 38 separate network intrusions. This indicates the group may have exploited an exposed shared application or a common vulnerability across these entities.
The n0n group emerged in September 2026 as a financially motivated extortion actor. According to SOCRadar’s tracker profile, the group typically gains access using credentials harvested by infostealer malware. It exfiltrates material such as Active Directory mappings and legal documents, then pressures victims with dark web leak postings. The group monetizes stolen data through these public leak postings rather than traditional ransomware deployment.
Who Is Affected
The affected organizations span multiple countries, with South Korea representing the largest share of the current claims. The targets include critical infrastructure components such as container terminals and port IT providers. Shipping lines and logistics companies are also among the listed victims. The data sets are described as small and application-scoped, with incomplete infostealer coverage across the victims.
SOCRadar cautioned that the claims remain unverified until confirmed by the affected organizations. The n0n group avoids traditional ransomware deployment but manipulates victim data using administrative tools. Its ATT&CK mapping includes encryption and recovery-inhibition techniques, meaning defenders should not rule out disruptive impact. Until an encryptor is publicly tied to the group, it is best treated as a data-theft operation with the access to cause damage.
What should you do?
Organizations in the maritime and logistics sectors should monitor dark web leak sites for their names and data. Security teams should review access logs for shared applications that connect multiple entities or partners. Administrators should verify the integrity of terminal system configuration records and shipping documentation. Users should remain vigilant for phishing attempts that may precede or follow such extortion claims.
What to do and how to stay safe: n0n
- Monitor dark web forums and leak sites for mentions of your organization or industry-specific data.
- Audit shared applications and third-party integrations for unauthorized access or configuration weaknesses.
- Review administrative tool usage logs for anomalies that could indicate data manipulation or exfiltration.
- Verify the integrity of critical operational data such as vessel schedules and container manifests.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which countries are most affected by the n0n group's latest claims?
South Korea accounts for 12 of the 38 entries, making it the country with the most listed organizations.
What type of data did the n0n group claim to steal?
The claimed data includes vessel schedules, container manifests, gate movement records, and terminal system configuration records.
Has the n0n group confirmed these breaches with the victims?
No, SOCRadar reported that the claims had not been publicly confirmed by any listed maritime organization.
