Thirty-eight organisations in the maritime and logistics sectors appeared on 12 October 2026 on the website used by the cybercrime group n0n to publish its claims. The group alleges that it has stolen data from terminal operators, shipping companies, port IT providers and logistics businesses, and is demanding ransom payments to prevent their disclosure. The deadline for payment is 19 October at 15:27 Italian time. The claims were reported on 13 October by cybersecurity company Socradar, which specialises in threat intelligence, in a report written by Omer Faruk Diken. At the time of publication, none of the organisations named had confirmed an incident.
The list includes twelve port and container terminal operators, ten shipping companies and shipowners, alongside IT providers, logistics businesses and other companies operating in the sector, spread across eighteen countries. It also includes industrial companies linked to the supply chain, such as Zpmc and Dongkuk Steel. The terminal operators named include Santos Brasil, Portonave, Superterminais, Asyaport, Bnct, Pusan Newport Company, Tti Algeciras, Eurogate Tanger, Nct Kandla, Nam Dinh Vu Port and Neom Ports. The shipping companies and shipowners include Ocean Network Express, Cu Lines, T.S. Lines, Polaris Shipping, Dong-A Tanker, Camellia Line and Samudera, while the IT systems and consultancy providers include Gncnet/Dgt Busan, Gcs Kuwait, Ilcs Pelindo, Hpc Hamburg Port Consulting and T2S. The list also features logistics and service providers such as Eusu Logistics, Yusen Logistics Hong Kong, Saehan Marine, April Asia, GlobalNet Lcl and Bmt Iq.
Socradar questions whether the 38 claims represent 38 separate intrusions. The archives examined, ranging in size from 60 MB to 2.4 GB, contain recurring similarities, while many of the organisations named have no matching records in the databases of credentials stolen by information-stealing malware consulted by the company. The data could therefore have originated from software shared by several operators, a centralised service or a single repository containing documents belonging to different companies. In outlining this possible mechanism, Socradar refers to the MOVEit case, in which the Cl0p group exploited vulnerability CVE-2023-34362 from 27 May 2023 to access data belonging to numerous organisations through file transfer software, as documented by the US Cybersecurity and Infrastructure Security Agency (Cisa). Socradar stresses that it has no evidence linking n0n to those campaigns.
The allegedly stolen material is operational and commercial in nature and varies from company to company. The published descriptions refer to archives of EDI messages, container manifests, vessel schedules, gate movement records, bookings and equipment interchange documents, as well as internal system configurations, software release and installation documentation, employee accounts and financial data. The latter include bunker cost calculations, demurrage and despatch accounts, and port disbursement accounts. The ransom demands examined by Socradar range from $2.4 million to $14 million. The highest concerns Eusu Logistics, with a demand of $14 million (approximately €12.5 million) for a claimed 60 MB archive. The group is demanding $2.4 million (approximately €2.1 million) from Ilcs Pelindo for 2.4 GB of data, and $6 million (approximately €5.4 million) from Eurogate Tanger, including an initial payment of 10%, equivalent to $600,000 (approximately €536,000), to gain access to a private negotiation area. In return for payment, the cybercrime group promises to destroy the data.
The n0n group emerged recently, in September 2026, and differs from many traditional cybercrime gangs because its operating model appears to focus almost exclusively on data theft and extortion, largely avoiding, or making only limited use of, the disruptive encryption that can bring companies' operations to a standstill. To increase the psychological pressure on victims, the entries published by n0n carry the explicit label "NOT PAID, EXPOSED", accompanied by a real-time countdown. The result resembles a public scoreboard, visible to anyone visiting the group's dark web site.
Antonio Illariuzzi
