Check if your maritime firm is among 38 targeted by n0n extortion group

Maritime and logistics professionals should verify whether their organization appears in a new data leak campaign by the n0n extortion group. According to a report by SOCRadar, the group has listed 38 global companies on its dark web site, claiming access to sensitive operational data. These listings cover sectors including container terminals, shipping lines, and port IT providers across 18 different countries.

Which organizations and data are involved?

The affected entities span multiple regions, with South Korea representing the largest share of the 38 listed organizations. According to SOCRadar, 12 of the victims are based in South Korea, including Busan terminal operators BNCT and Pusan Newport Company. Other listed firms include general logistics companies and shipping lines. The data reportedly stolen includes vessel schedules, container manifests, gate movement records, shipping documentation, and terminal system configuration records.

What is the ransom demand and deadline?

The n0n group has set a publication deadline of 19 October 2026, at 13:27 UTC, for the release of the stolen material. According to SOCRadar, the settlement demands for these victims range from $2.4 million to $14 million. The group emerged in September 2026 and operates as a financially motivated extortion team that monetizes stolen data through public leak postings. No listed maritime organization has publicly confirmed the breach claims at the time of the report.

How did the attackers likely gain access?

SOCRadar suggests the intrusion method may involve a shared entry point rather than 38 separate network breaches. The analyst firm noted that the data sets are small and narrowly scoped, with incomplete infostealer coverage across the victims. This pattern points to a possible exposed shared application or a common vulnerability. The group typically gains access using credentials harvested by infostealer malware, exfiltrating material such as Active Directory mappings and legal documents.

What is the nature of the n0n threat group?

The n0n group avoids traditional ransomware deployment but retains the capability for disruptive impact. According to its profile, the group manipulates victim data using administrative tools and pressures victims with dark web postings. However, its ATT&CK mapping includes encryption and recovery-inhibition techniques. Defenders should treat n0n as a data-theft extortion operation with the access to cause damage, even until an encryptor is publicly tied to the group.

What affected people can do

Staff at listed organizations should immediately check internal logs for unauthorized access to terminal systems or shipping documentation. Teams usually review Active Directory mappings to identify any new administrative accounts created by attackers. Users should verify whether their credentials have been exposed in recent infostealer incidents. Employees must remain vigilant for follow-up scams that mimic official communications regarding the leak. Organizations should ensure that sensitive vessel schedules and container manifests are not accessible via unsecured shared applications until the scope of the breach is fully understood.

Background: Unauthorized access

The difference between authorized and unauthorized access lies in explicit permission. Authorized access occurs when a system grants entry based on verified identity and defined scope. Unauthorized access happens when an entity enters or acts without this consent, whether through stolen credentials or by exceeding their granted privileges.

Read the full guide: Difference Between Authorized and Unauthorized Access: The Hidden Boundaries

What to do and how to stay safe: n0n

• Review access logs for terminal systems and shipping documentation repositories to detect unauthorized activity.
• Verify whether employee credentials have been compromised by checking for signs of infostealer malware infection.
• Audit shared applications and public-facing systems for vulnerabilities that could allow external access.
• Monitor dark web forums for mentions of your organization’s name or specific data sets like container manifests.

Step-by-step guide: Stop Credential Leaks: A Practical Prevention Checklist

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Has any of the listed maritime firms confirmed the breach?

No, SOCRadar stated that the claims had not been publicly confirmed by any listed organization and remained unverified.

What specific types of data are reportedly stolen?

The stolen data includes vessel schedules, container manifests, gate movement records, shipping documentation, and terminal system configuration records.

Is n0n deploying ransomware encryption on these victims?

The group avoids traditional ransomware deployment but its ATT&CK mapping includes encryption techniques, so disruptive impact should not be ruled out.