n0n Claims Data Theft From 38 Maritime Organizations

Key Takeaways

• n0n claims it stole operational data from 38 maritime and logistics organizations across 18 countries, although no listed victim had publicly confirmed a breach when reports emerged.
• Reported extortion demands range from $2.4 million to $14 million, with n0n threatening to publish data on 19 October 2026.
• The similarity of the alleged records raises questions about a shared application, EDI platform or access route, but investigators have not verified a common entry point.

A cyber extortion campaign targeting shipping, port and logistics operations is putting the maritime sector's interconnected technology stack under fresh scrutiny.

n0n claims to have stolen information from 38 shipping lines, ports, terminals, logistics providers and maritime-IT organizations across 18 countries. According to The Loadstar, none of the affected organizations had publicly confirmed a breach when the campaign was reported. The claims therefore remain unverified allegations rather than established compromises.

Organizations named in reporting include Ocean Network Express (ONE), Eurogate Tanger and Santos Brasil. CULines, T.S. Lines and Yusen Logistics Hong Kong also appear among the listed entities, according to Safety4Sea.

The alleged data is potentially more consequential than a conventional collection of employee credentials or customer records. n0n says it obtained EDI messages, container manifests, vessel schedules, gate-movement information, equipment-interchange records, terminal configurations and software-deployment materials.

Those records sit close to the operational heart of cargo movement. EDI messages coordinate transactions among carriers, terminals, customs brokers, freight forwarders and other participants. Equipment-interchange records document custody changes, while gate data can reveal when containers enter or leave controlled facilities.

That changes the risk calculation. If authentic and sufficiently current, leaked records could give criminals insight into cargo flows, valuable shipments, operational dependencies and the timing of container movements. They could also make phishing and impersonation attempts more convincing. A fraudulent request containing a real vessel name, container identifier or gate reference will look more credible than a generic message.

Could such information support cargo diversion? Potentially, although possession of records alone does not establish that an attacker can alter terminal systems or redirect freight. Physical controls, customs processes and separate authorization layers still matter. Even so, operational context can help attackers identify where those safeguards may be weakest.

The reported extortion model does not depend on encrypting systems in the style associated with conventional ransomware. The profile instead describes the use of administrative tools to manipulate or collect victim data, followed by pressure based on threatened disclosure. That can leave systems functioning while creating a serious incident behind the scenes.

SOCRadar-reviewed demands reportedly range from $2.4 million to $14 million. PortNews reports that n0n has threatened publication on 19 October 2026. That deadline gives affected organizations a narrow window to investigate access logs, establish what data may have left their environments and coordinate legal, regulatory and customer communications.

The concentration of similar record types across multiple organizations is another concern. It may point to a shared application, an EDI service, a maritime software supplier or a reused access route. No common entry point has been verified, however. Independent compromises could also produce comparable datasets because ports and carriers rely on many of the same document formats and operational processes.

That said, the pattern should prompt organizations to examine more than their own perimeter. Reviews can include third-party identities, remote support accounts, API credentials, service accounts, file-transfer systems and privileged access associated with maritime applications. Session histories and bulk exports may be especially relevant when extortion centers on data theft rather than encryption.

The IMO Maritime Cyber Risk Management Guidelines provide a maritime-specific basis for incorporating cyber risk into safety management. NIST Cybersecurity Framework 2.0 offers complementary guidance for governance, identity controls, supplier oversight, detection and incident response. Neither framework eliminates exposure, but both can help organizations assign ownership and test whether response plans reflect operational technology and port-community dependencies.

For Ocean Network Express (ONE), Eurogate Tanger, Santos Brasil, CULines, T.S. Lines and Yusen Logistics Hong Kong, public naming creates reputational pressure before technical findings are available.

The wider lesson reaches beyond the 38 organizations on n0n's list. Maritime businesses exchange sensitive operational information across long supplier chains, often through systems designed for availability and rapid coordination. When extortionists target those shared information flows, confidentiality incidents can quickly become cargo-security and business-continuity problems. Whether n0n's full claims prove accurate or not, the campaign shows why ports, carriers and logistics providers need visibility into who can access operational data, how much they can extract and how quickly unusual activity can be contained.