38 Ports and Shipping Lines, One Countdown: The n0n Group’s Audacious Maritime Extortion Play

On October 12, a cyber extortion group calling itself n0n Group did something that established ransomware brands rarely do. It posted the names of 38 maritime, port, and logistics organizations on its dark web leak site all at once, and started a clock: pay in Bitcoin by October 19, or watch your data go public. The demands range from $2.4 million to $14 million per organization.

The group claims to hold EDI messages, cargo manifests, gate and equipment interchange records, terminal system configuration files, release documents, and shipping documentation. As of October 15, not one of the 38 named organizations had publicly confirmed a breach. That silence, in an industry that moves roughly 90 percent of world trade on ships, is the story as much as the claim itself.

What makes this campaign worth watching is not only its scale, but its design. SOCRadar, the threat intelligence firm tracking n0n Group, describes it as a data-theft extortion operation rather than conventional ransomware: no files encrypted, no systems locked, just stolen data and a threat to publish. The group emerged only in September 2026, which makes this its first large multi-victim operation. And researchers suspect the 38 listings may trace back to a single shared entry point rather than 38 separate intrusions.

The list and the deadline

The 38 named organizations span 18 countries. According to trade-press reporting that reviewed the leak listing, the breakdown includes 12 port and container terminal operators, 10 shipping lines or shipowners, and the remainder made up of port IT providers, logistics companies, and maritime service businesses. Named targets include Ocean Network Express, CULines, T.S. Lines, Samudera, Santos Brasil, Portonave, Pusan Newport Company, BNCT, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port, NEOM Ports, and Chinese port crane manufacturer ZPMC. South Korea alone accounts for 12 of the 38 entries.

The publication deadline was set for October 19, 2026, at 13:27 UTC, reported consistently across Safety4Sea, Splash247, and TrasportoEuropa. Settlement demands reviewed by SOCRadar ranged from $2.4 million to $14 million, all payable in Bitcoin. In at least one case, Eurogate Tanger was reportedly asked to pay 10 percent of a $6 million demand simply to access a private negotiation room. The negotiability of some demands is, notably, part of the pitch.

The batch-style disclosure is the unusual part. Established extortion brands usually drip-feed victims one at a time, using each new name to pressure the rest. Dropping all 38 at once concentrates media attention on an entire sector in a single news cycle and forces every named company to respond simultaneously, before any one of them has had time to quietly settle.

Why maritime data commands that price

Cargo manifests and gate records are not the kind of data that sells well on criminal forums. They are valuable for a different reason: they describe what is physically moving through a terminal and when. EDI messages are the backbone of how carriers, ports, and customs systems exchange booking and shipment data. For an extortionist, that operational granularity is the leverage, because it cannot be reissued or rotated the way a password can.

The terminal system configuration files are the category that caught researchers’ attention. If genuine, those files could reveal how a facility’s operational technology is wired together: cranes, gate automation, container tracking systems. That is industrial-control intelligence, a category of exposure that goes beyond a back-office data leak and could, in theory, inform follow-on attacks against the physical operation of a port. No reporting indicates n0n Group has threatened any disruption of operational technology itself, but the presence of configuration data in the claimed haul changes the risk conversation for defenders.

There is also a structural reason maritime lists are so long. A small number of software platforms, port community systems, and service providers sit behind a large share of the world’s shipping operations. Compromise one shared environment, and you can plausibly name dozens of otherwise unrelated companies in a single batch.

A terminal operator whose gate systems go dark has no choice but to disclose the problem. A company facing only a threat to publish stolen files can, and often does, choose silence while it investigates privately.

The shared entry point theory

SOCRadar’s most technically interesting observation is that the datasets appear small, application-scoped, and consistent in character across victims, with incomplete infostealer credential matches for many listed organizations. The firm’s assessment is that this pattern points to a likely shared entry point, such as an exposed shared application or an unpatched vulnerability in common maritime software, rather than 38 separate network intrusions.

Israeli maritime cybersecurity company Cydome independently reached a similar conclusion, identifying a possible connection to a shared software environment. If that theory holds, the defense response changes shape: patching is not 38 separate jobs but one systemic one, and any port or carrier using the same environment should assume exposure regardless of whether its name appeared on the list. The history here is instructive. The 2017 NotPetya outbreak crippled Maersk’s global IT systems for days and forced the company to rebuild much of its network from scratch, an event that reshaped how the shipping industry thought about segmentation and incident response. This campaign is the inverse of that one: no visible disruption, no forced disclosure, just a threat and a countdown.

What happens on October 19

If the deadline passes without payment from a given organization, the usual next step is a partial or full release of the claimed data on the group’s leak site, intended to punish non-payers and to pressure the remaining named companies into settling before their own data goes public. The critical test will be what gets published: authentic port and shipping records, or recycled and fabricated files. Until samples are examined independently, the gap between claim and confirmed compromise remains the central uncertainty.

For companies on the list, the playbook is well established: isolate and audit systems handling EDI traffic and terminal configuration data, review third-party and vendor access logs around the claimed intrusion window, and prepare a communications plan in case customers or partners ask questions before an internal investigation concludes. Companies that were not named but share the same IT providers should not assume they are unaffected. And cyber insurance underwriters covering maritime clients routinely treat a named appearance on an extortion list as a reportable event, confirmed breach or not.

The broader signal is the maturation of data-theft extortion as a standalone business model. Encryption was always optional; what pays is leverage. A new group, one month old, has learned to manufacture it at industrial scale, and picked the one sector where operational data is hardest to replace.