n0n Group's Maritime Mass-Extortion Play: 38 Ports and Shipping Firms Face an October 19 Deadline

On October 12, 2026, an extortion group calling itself n0n added 38 names to its dark web leak site in a single batch, all of them in maritime: port and terminal operators, shipping lines, logistics companies, and the IT providers behind global cargo. The message was blunt. Pay in Bitcoin, or the stolen data the group claims to hold goes public on October 19.

As of October 15, not one of the 38 organizations had publicly confirmed a compromise. That silence is the most easily misread fact in this story: in a data-theft extortion campaign there is no ransom screen on a locked server, no alert that forces a disclosure. There is only a list, a deadline, and a group that says it holds your cargo manifests, gate records, and terminal configuration files.

What n0n claims to have stolen

According to threat intelligence firm SOCRadar, the material n0n claims to hold reads like the operating manual of a modern port: EDI messages, cargo manifests, gate and equipment interchange records, terminal system configuration data, cargo release documents, and deployment materials, as reported by the Maritime Executive and Safety4Sea. EDI messages are the structured documents that carriers, ports, and customs use to exchange booking and clearance data; a trove of them reveals who is shipping what, for whom, and when. Manifests and gate records map container movements through a terminal in near real time, a detailed picture of cargo flows with commercial and potentially strategic value.

Terminal system configuration data most worries security specialists, since files describing terminal operating systems, gate automation, and container tracking reveal how a facility's operational technology is architected. No reporting suggests n0n has threatened disruptive action against operational technology itself. None of the claimed material has been independently verified by any third party.

Who is on the list

The 38 organizations span 18 countries, according to Safety4Sea and The Loadstar. TrasportoEuropa and Logistikk Inside report the list divides into 12 port and terminal operators and 10 shipping lines or shipowners, with the rest made up of IT providers, logistics businesses, and other maritime service companies.

Named organizations include shipping lines Ocean Network Express, CULines, T.S. Lines, and Samudera, terminal operators Santos Brasil, Portonave, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port, and NEOM Ports, plus Chinese crane manufacturer ZPMC and the Dutch office of the Premier Alliance.

The geographic concentration is striking: SOCRadar notes that 12 of the 38 entries are in South Korea, including Busan terminal operators BNCT and Pusan Newport Company. That clustering has pushed researchers toward a theory about how a young group could claim so many victims at once.

The extortion-only playbook

n0n skips the encryption entirely. Rather than deploying malware that locks a victim's files and demands payment for a decryption key, the group claims to have copied data and threatens to publish it. Security researchers call this data-theft extortion, and Naftemporiki reported that SOCRadar characterizes n0n in exactly those terms.

n0n is not breaking in and locking the doors behind it. It is copying the floor plans, the cargo lists, and the gate logs, then selling the industry back its own secrets.

What makes this campaign unusual is the scale and style of the disclosure. Established ransomware brands typically drip-feed victims one at a time; n0n posted all 38 in a single batch, concentrating pressure across an entire industry in one news cycle before any victim can quietly negotiate. The group has also commercialized its own negotiations: Splash247 reported that SOCRadar found entries offering what amounts to pay-to-negotiate access, with Eurogate Tanger allegedly asked to pay 10 percent of a roughly $6 million demand just to enter a private negotiation room. Demands reviewed by SOCRadar ranged from $2.4 million to $14 million per organization, payable in Bitcoin.

Who is n0n

By ransomware standards, n0n is a newcomer. Naftemporiki reported it emerged in September 2026, and SOCRadar's tracker describes a financially motivated operation that gains access with infostealer-harvested credentials, exfiltrates material such as Active Directory mappings and legal documents, then pressures victims through dark web leak postings. SOCRadar rates the group near the top of its aggressiveness scale; its tracker lists the likely source country as Russia, though that attribution is preliminary.

Before the maritime wave, n0n's 21 listings across 17 countries were broad and opportunistic, spanning investment, telecom, retail, education, and pharmaceuticals, with claims against Fanatics, Transcom WorldWide, and AstraZeneca Türkiye among them.

SOCRadar adds one caveat for defenders: n0n's attack mapping still includes encryption and recovery inhibition techniques, so the capability for disruptive impact should not be ruled out.

The shared-system theory

The question hanging over the campaign is mechanical: how does a month-old group claim to have breached 38 companies across 18 countries? SOCRadar's answer is that it probably did not. The firm points to small, application-scoped data sets and incomplete infostealer credential coverage as evidence of a likely shared entry point: one exposed shared application or vulnerability rather than dozens of distinct network breaches.

Israeli maritime cybersecurity firm Cydome independently identified a possible connection to a shared software environment, according to beinsure's reporting. The geographic clustering in South Korea and the common data categories support the idea that victims may share a software platform or service provider. A small number of software platforms now sits behind a large share of the world's port and shipping operations, so one compromised vendor could expose dozens of otherwise unrelated companies at once. When that concentration is exploited, the blast radius is measured in industries, not companies.

Why the industry cannot shrug this off

The maritime sector has reason to take extortion claims seriously. The reference case is the 2017 NotPetya outbreak, which crippled shipping giant Maersk's global IT systems for days and forced the company to rebuild much of its network from scratch.

What distinguishes the n0n campaign is the shift from disruptive malware that visibly knocks systems offline to quieter data-theft extortion that may never be publicly acknowledged unless the group follows through on its leak threat. A company facing only a threat to publish files can choose silence while it investigates privately. Even an unverified claim carries commercial weight: insurers treat an appearance on an extortion group's list as a reportable event, and named companies may face client questions about data handling and cybersecurity warranties.

What happens at the October 19 deadline

The deadline is October 19, 2026, at 13:27 UTC, corroborated by Safety4Sea, The Loadstar, and TrasportoEuropa. If it passes without payment, the typical next step is a partial or full release of the claimed data on the group's leak site, meant to punish non-payers and pressure the rest into settling.

Whether any of the 38 organizations pays, and whether published data turns out to be genuine port and shipping records rather than recycled or fabricated files, will be the clearest test of how real this threat is. Security teams are advised to review access logs for EDI and terminal systems, audit vendor connections, and prepare incident response plans now. The verdict will not arrive in a press release. It will arrive in the files the group does or does not publish, and in what independent researchers find when they open them.