n0n Group Ransomware Threatens 38 Maritime Firms [2026] | #ransomware | #cybercrime

A ransomware and data-extortion operation calling itself n0n Group has published a list of 38 maritime, port, and logistics organizations it claims to have breached, threatening to release stolen operational data unless payment arrives by October 19, 2026. The disclosure, first reported by Maritime Executive, has rattled an industry still recovering from a string of high-profile cyber incidents over the past decade, and it lands at a moment when ports and shipping lines are increasingly dependent on networked systems to move cargo around the globe.What n0n Group Claims to Have StolenThe 38 Companies and 18 Countries at RiskNamed Targets: From Ocean Network Express to Pusan NewportKey Figures in the n0n Group Extortion CampaignHow n0n Group’s Extortion Model WorksWhy Port and Terminal Data Is So ValuableSOCRadar’s Assessment and the Credibility QuestionHistorical Context: Maritime Cybersecurity’s Rough Decaden0n Group vs Other 2026 Extortion OperationsMarket and Industry Impact: Shipping, Insurance, LogisticsWhat Happens When the October 19 Deadline ArrivesFive Predictions for What Comes NextWhat Maritime and Logistics Companies Should Do NowFrequently Asked QuestionsRelated Coverage

As of October 15, 2026, none of the named organizations has publicly confirmed a breach, according to PortNews. That gap between a criminal group’s claims and verified technical evidence is itself part of the story: extortion-only operations increasingly skip the step of proving access before posting victim names, betting that reputational pressure alone will produce a payout.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.

One email a week. No spam, unsubscribe anytime.

Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

What n0n Group Claims to Have Stolen

n0n Group posted its full list of 38 organizations in a single batch on October 12, 2026, according to Maritime Executive and corroborated by TrasportoEuropa. The group says the data it holds includes EDI messages, cargo manifests, gate and equipment-interchange records, terminal-system configuration data, release documents, and what Maritime Executive described as deployment material tied to maritime operating systems. None of that material has been independently verified as genuine, and no sample has been confirmed by a third party as of this writing.

The categories of data being threatened matter because of what they could enable if real. Cargo manifests and gate records describe what is physically moving through a terminal and when; EDI messages are the backbone of how carriers, ports, and customs systems exchange booking and shipment data. Terminal configuration files, if authentic, could expose how a facility’s operational technology is wired together, information that in the wrong hands has value well beyond a simple data leak.

The 38 Companies and 18 Countries at Risk

The organizations named by n0n Group span 18 countries, according to Safety4Sea and the trade outlet Logistikk Inside. TrasportoEuropa reports that the list breaks down into 12 port and container-terminal operators and 10 shipping lines or shipowners, with the remainder made up of IT providers, logistics businesses, and other service companies connected to maritime supply chains. That spread, rather than a narrow focus on a single carrier or port authority, is one reason the claim has drawn attention from trade press across Europe, Asia, and South America rather than staying confined to a single regional outlet.

Shipping-sector news site The Loadstar independently confirmed the same breakdown, describing the targets as spanning container terminals, shipping lines, port IT providers, and logistics companies. The consistency of that breakdown across multiple outlets, each pulling from the same leaked listing, suggests the claim itself is at minimum a coherent and deliberately organized disclosure, whatever the underlying truth of the access turns out to be.

Named Targets: From Ocean Network Express to Pusan Newport

Regional outlet Logistikk Inside named several of the organizations appearing on n0n Group’s list, including Ocean Network Express, CULines, T.S. Lines, Samudera, Santos Brasil, Portonave, Pusan Newport Company, and Eurogate Tanger. Dutch shipping publication NT separately reported that Ocean Network Express, CULines, T.S. Lines, and ZPMC appeared on the list, alongside the Dutch office of the Premier Alliance.

The overlap between these two independent reports on at least three names, Ocean Network Express, CULines, and T.S. Lines, adds weight to the claim that the listing is genuine in the sense that it was actually posted and named real companies, even though it does not confirm that any system was actually compromised. None of the companies named has issued a public statement confirming or denying a breach as of October 15, 2026, based on available reporting.

Key Figures in the n0n Group Extortion Campaign

The table below summarizes the core facts reported across multiple outlets as of October 15, 2026.

DetailReported FigureSource

Organizations listed38Maritime Executive, Safety4Sea
Countries represented18Safety4Sea, The Loadstar, PortNews
Port/terminal operators named12TrasportoEuropa, Logistikk Inside
Shipping lines/shipowners named10TrasportoEuropa, Logistikk Inside
Date list was postedOctober 12, 2026Maritime Executive, PortNews
Payment deadlineOctober 19, 2026, 13:27 UTCSafety4Sea, The Loadstar
Ransom demand range$2.4 million to $14 million per organizationSafety4Sea, The Loadstar, Logistikk Inside
Demanded currencyBitcoinThe Loadstar, PortNews
Confirmed breaches as of Oct. 150 publicly confirmedPortNews

How n0n Group’s Extortion Model Works

n0n Group appears to be following a now-familiar playbook among cybercriminal operations: rather than deploying ransomware to encrypt a victim’s files and demand payment for a decryption key, the group claims to have simply copied data and is threatening to publish it. Security researchers broadly describe this as a data-theft extortion model, distinguishing it from traditional encryption-based ransomware that locks victims out of their own systems. Greek outlet Naftemporiki reported that threat-intelligence firm SOCRadar characterized the operation in exactly those terms, describing it as a data-theft extortion operation rather than a conventional ransomware deployment.

Naftemporiki also reported that n0n Group itself only emerged in September 2026, making this maritime-sector disclosure one of the group’s first large, multi-victim operations since it appeared on researchers’ radar. A new group posting 38 names in a single batch, rather than drip-feeding victims one at a time as many established ransomware brands do, is itself an unusual move, one that maximizes public pressure across an entire industry sector at once rather than targeting companies individually.

Why Port and Terminal Data Is So Valuable

Ports and container terminals sit at a unique chokepoint in global trade. A single major terminal operator can handle bookings, customs declarations, and physical gate operations for dozens of shipping lines simultaneously, which means a breach touching one operator’s systems can ripple outward to every carrier that relies on it. That interconnection is precisely why cargo manifests, EDI messages, and gate records carry outsized value to an extortion group: they are not just internal business records, they are the operational glue between otherwise competing companies.

Terminal-system configuration data, if genuine, raises a separate concern. Configuration files for operational technology, cranes, gate automation, container-tracking systems, can reveal how a facility’s industrial control systems are architected. That is a different category of risk than a simple customer-data leak, since it could in theory inform follow-on attacks against the physical operation of a port rather than just its back-office records. No evidence in current reporting indicates n0n Group has taken or threatened any disruptive action against operational technology itself, only that configuration data is among the categories of information the group claims to hold.

SOCRadar’s Assessment and the Credibility Question

The involvement of an established threat-intelligence firm gives the claim more weight than a typical anonymous extortion post. SOCRadar’s assessment, as reported by Naftemporiki, treated the listing as a legitimate data-theft extortion campaign worth tracking rather than dismissing it as an unsubstantiated bluff. That is a meaningful distinction in an industry where fabricated or exaggerated breach claims are common, and where some extortion groups have been known to list victims they never actually accessed simply to extract a payment from a frightened company.

Even so, an assessment that a campaign is real and organized is not the same as forensic confirmation that any specific company’s systems were compromised. PortNews was explicit on this point, noting that none of the listed maritime organizations had publicly confirmed a breach at the time of its reporting. Readers and affected companies should treat the current situation as an unverified extortion claim with corroborated existence, not as a confirmed mass breach, until individual organizations or independent forensic investigators say otherwise.

Historical Context: Maritime Cybersecurity’s Rough Decade

The maritime and logistics sector has a well-documented history of disruptive cyber incidents. The most widely cited example remains the 2017 NotPetya malware outbreak, which crippled shipping giant Maersk’s global IT systems for days and forced the company to rebuild much of its network from scratch, according to years of subsequent industry reporting on the incident. That event reshaped how the shipping industry thought about cybersecurity, pushing many carriers and terminal operators toward segmented networks and more formal incident-response planning.

What makes the current n0n Group situation different from that history is the shift from disruptive malware that visibly knocks systems offline to quieter data-theft extortion that may never be publicly acknowledged at all unless the group follows through on its leak threat. A terminal operator whose gate systems go dark, as happened broadly across Maersk’s network in 2017, has little choice but to disclose the problem. A company facing only a threat to publish stolen files can, and often does, choose silence while it investigates privately, which is consistent with the lack of public confirmations seen so far in this case.

n0n Group vs Other 2026 Extortion Operations

The table below places n0n Group’s reported tactics alongside the broader category of data-theft-only extortion operations that threat-intelligence firms have tracked through 2025 and 2026, based on the characteristics described across this week’s reporting.

Characteristicn0n Group (this campaign)Typical Encryption Ransomware

Primary methodData theft and leak threat, no reported encryptionEncrypts victim files, demands decryption key payment
Victim disclosure style38 names posted in one batchUsually one victim disclosed at a time
Demand range (this case)$2.4M-$14M per organizationVaries widely by victim size and data sensitivity
Payment currencyBitcoinTypically cryptocurrency, most often Bitcoin or Monero
Operational disruption reportedNone confirmed as of Oct. 15, 2026Frequently causes immediate operational outages
Group ageEmerged September 2026Established brands often operate for years

The batch-style disclosure of all 38 names at once, rather than the staggered naming common among established ransomware brands, stands out as the most unusual element of n0n Group’s approach. It concentrates public and media attention across an entire industry in a single news cycle, which may be a deliberate strategy to pressure multiple victims simultaneously before any one of them has time to quietly negotiate and settle before the group needed to make its threat public.

Market and Industry Impact: Shipping, Insurance, Logistics

For an industry that runs on tight scheduling and interlocking contracts between carriers, terminal operators, and freight forwarders, even an unverified breach claim carries commercial weight. Cyber-insurance underwriters covering maritime and logistics clients routinely treat a named appearance on an extortion group’s victim list as a reportable event requiring review, regardless of whether a breach is later confirmed. Companies named on the list, even if ultimately unaffected, may face client questions about data-handling practices and contractual obligations tied to cybersecurity warranties in shipping and logistics contracts.

The breadth of the list, spanning 18 countries and covering port operators, shipping lines, and the IT providers that service them, also illustrates how concentrated risk has become in global logistics. A relatively small number of software platforms and service providers now sit behind a large share of the world’s port and shipping operations, meaning a single compromised vendor, if that turns out to be how n0n Group gained any access it claims to have, could expose dozens of otherwise unrelated companies at once. That structural reality is a recurring theme in supply-chain cybersecurity analysis well beyond this single incident.

What Happens When the October 19 Deadline Arrives

n0n Group set its publication deadline for October 19, 2026, at 13:27 UTC, equivalent to 15:27 in Rome, according to matching reports from Safety4Sea, The Loadstar, and TrasportoEuropa. If the deadline passes without payment from a given organization, the next step in this kind of extortion campaign is typically a partial or full release of the claimed stolen data on a leak site, intended both to punish the non-paying victim and to pressure the remaining named organizations into settling before their own data goes public.

Whether any of the 38 organizations actually pays, and whether any data that does get published turns out to be genuine, authentic port and shipping records rather than recycled or fabricated files, will be the clearest test of how real this specific threat actually is. Until files are published and independently examined, the gap between claim and confirmed compromise remains the central uncertainty in this story.

Five Predictions for What Comes Next

At least some of the 38 named organizations will issue public statements in the days around the October 19 deadline, either confirming an investigation or denying any compromise, as media pressure builds.
If n0n Group follows through on publishing data, independent researchers and journalists will move quickly to verify whether the leaked files are authentic, recycled from older breaches, or partly fabricated.
Maritime industry associations and port-security working groups are likely to issue guidance or warnings to members in response, given the sector-wide nature of the claimed targeting.
Cyber-insurance carriers serving shipping and logistics clients will likely see a short-term uptick in inquiries and claims-related contact tied to this specific listing.
Regardless of how this particular case resolves, expect continued growth in data-theft-only extortion claims against supply-chain and logistics targets through the rest of 2026, following the broader pattern threat-intelligence firms have tracked this year.

What Maritime and Logistics Companies Should Do Now

Security teams at companies named, or that fear they could be named, on lists like this one generally follow a consistent response pattern: isolate and audit systems that handle EDI traffic and terminal configuration data, review third-party and IT-vendor access logs for the weeks surrounding the claimed intrusion window, and prepare a communication plan in case customers or partners ask about the listing before an internal investigation concludes. Because the claimed data categories include records shared between competing carriers through shared terminal systems, companies that were not named directly but rely on the same IT providers as those that were should not assume they are unaffected.

More broadly, the incident is a reminder that the shipping industry’s reliance on a relatively small set of shared digital infrastructure, port community systems, terminal operating software, and EDI gateways, creates concentrated risk that a single group, real or exaggerating its access, can turn into an industry-wide news event within days. Companies that have not reviewed their incident-response plans for a data-theft-only scenario, as opposed to a disruptive ransomware outage, may find this a useful prompt to do so before any of their own names appear on a future list.

Frequently Asked Questions

What is n0n Group?n0n Group is a cybercriminal extortion operation that, according to Naftemporiki, emerged in September 2026. It posted a list of 38 maritime, port, and logistics organizations it claims to have breached, threatening to leak stolen data.

Which companies were named in the n0n Group listing?Regional reporting from Logistikk Inside and NT named Ocean Network Express, CULines, T.S. Lines, Samudera, Santos Brasil, Portonave, Pusan Newport Company, Eurogate Tanger, ZPMC, and the Dutch office of the Premier Alliance among the 38 organizations listed.

Has any company confirmed a breach?No. As of October 15, 2026, PortNews reported that none of the 38 listed organizations had publicly confirmed a breach.

What data is n0n Group threatening to leak?Maritime Executive reported the threatened categories include EDI messages, cargo manifests, gate and equipment-interchange records, terminal-system configuration data, release documents, and deployment material.

How much money is n0n Group demanding?Safety4Sea, The Loadstar, and Logistikk Inside each reported demands ranging from $2.4 million to $14 million per organization, payable in Bitcoin.

When is the payment deadline?October 19, 2026, at 13:27 UTC (15:27 in Rome), according to Safety4Sea, The Loadstar, and TrasportoEuropa.

Is this traditional ransomware or something else?Threat-intelligence firm SOCRadar characterized it as a data-theft extortion operation rather than conventional encryption-based ransomware, according to Naftemporiki, meaning there are no reports of systems being locked or encrypted.

What should companies in the shipping and logistics sector do now?Security teams typically review access logs for systems handling EDI and terminal data, audit third-party IT vendor connections, and prepare incident-response and communication plans in case customers raise questions before an internal investigation is complete.

Related Coverage
Marcus ChenGaming & Consumer Tech EditorMarcus Chen is a senior editor at Tech Insider, where he leads coverage of the US online gaming market, including sweepstakes and social casinos, alongside consumer technology. He evaluates operators on their published terms, licensing and RNG certifications, stated redemption policies, and corroborating independent reporting, and writes plainly about what the evidence supports. Tech Insider does not run first-party money tests and does not gamble with reader funds. Marcus has reported on the technology and online-gaming industries for more than a decade.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.

One email a week. No spam, unsubscribe anytime.

Click Here For The Original Source.

——————————————————–

…………

Related