🔔 Subscribe to ShipUniverse Weekly →
A newly emerged cyber extortion operation known as n0n listed 38 maritime, port and logistics organizations on its dark-web leak site on October 12, threatening to release allegedly stolen data on October 19 unless multimillion-dollar payments are made. The batch spans 18 countries and includes Ocean Network Express, CULines, T.S. Lines, Samudera, Santos Brasil, Portonave, Pusan Newport Company, BNCT, Eurogate Tanger and other shipping, terminal, logistics and port-technology organizations. SOCRadar, which analyzed the postings, says none of the 38 organizations had publicly confirmed a compromise when its report was published, so the breach claims, stolen-data descriptions and suspected attack path remain unverified. Reviewed demands range from $2.4 million to $14 million.
38 Maritime Names Appeared at Once. The Bigger Question Is Whether They Came From One System.
The listings span carriers, terminals, port IT providers, logistics companies and industrial suppliers. Researchers say the pattern of the claimed data looks more like application-level exposure than 38 separate enterprise-wide compromises.
Posted by n0n in a single batch on October 12.
Claims stretch across Asia, Europe, the Middle East and the Americas.
The largest geographic concentration in the maritime batch.
SOCRadar found multimillion-dollar settlement demands denominated in Bitcoin.
Reviewed listings show a common 13:27 UTC deadline.
Three Different Levels of Certainty
Multiple threat-intelligence services independently observed the n0n listings. The existence of the extortion campaign itself is not in dispute.
n0n claims to hold operational and commercial data from the named organizations. No listed maritime organization had publicly verified those claims when researchers published their analysis.
Similar data types, small archive sizes and the simultaneous posting pattern led SOCRadar to suspect one shared application, integration layer or vulnerability rather than 38 unrelated intrusions.
The 38 Names Reach Across the Container Supply Chain
The concentration of carriers, terminals, port-technology providers and logistics intermediaries is one reason researchers are looking beyond the possibility of 38 unrelated enterprise breaches.
| Segment | Organizations Named by n0n | Count | Examples of Relevant Data | Current Verification |
|---|---|---|---|---|
| Ports & Container Terminals | Santos Brasil, Portonave, Superterminais, Asyaport, MGNP, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, NCT Kandla, Nam Dinh Vu Port and NEOM Ports. | 12 | Container manifests, gate movements, vessel schedules, terminal documentation and operational records could exist in shared systems. | Threat-Actor Claims No public confirmation of the n0n breach claims at time of research. |
| Shipping Lines & Ship Operators | Ocean Network Express, CULines, T.S. Lines, Polaris Shipping, Dong-A Tanker, Samjoo Maritime, Korea Ferry, Camellia Line, Tsuneishi / Kambara Kisen and Samudera. | 10 | Booking exchanges, vessel schedules, manifests, commercial records and operational messages may pass between lines and terminals. | Threat-Actor Claims Listings are documented; compromise remains unconfirmed. |
| Port IT / EDI / Terminal Systems | GNCNet / DGT Busan, GCS Kuwait, ILCS Pelindo, HPC Hamburg Port Consulting and T2S. | 5 | Integration configuration, EDI archives, deployment documentation and software or terminal-system records. | High Research Interest Their presence strengthens the shared-platform hypothesis but does not prove it. |
| Agencies, Logistics & Depots | Saehan Marine, EUSU Logistics, BKH ICD, April Asia, GlobalNet LCL, Yusen Logistics Hong Kong, Premier Alliance and BMT IQ. | 8 | Equipment interchange, invoices, inspection records, port disbursement information and infrastructure configuration. | Unverified Public reporting also notes uncertainty over the exact identity intended by the “BMT IQ” listing. |
| Adjacent Maritime Industry | ZPMC, Apical Group and Dongkuk Steel. | 3 | Industrial, terminal-equipment and commercial supply-chain information could intersect with maritime partners. | Unverified |
What n0n Claims to Have From Selected Organizations
Claimed EDI message files covering schedules, manifests, gate movements and booking exchanges.
Claimed archive of EDI container manifests and operational records.
Claimed container records, EDI files, deployment material and terminal configuration information.
Claimed commercial configuration, release documentation and container/vessel records.
Claimed invoices, equipment interchange receipts and inspection records.
Claimed infrastructure configuration, assessment records and internal systems material.
A full corporate-network compromise often produces a much broader and larger collection. The reviewed n0n archives are narrow, structured and application-specific, which is consistent with extracting data from one functional platform or integration service.
An EDI archive at one terminal can contain information belonging to every carrier, forwarder or customer exchanging messages through it. A company's data can therefore be exposed even when that company's own network was never penetrated.
Maritime Counterparty Exposure Triage
A company does not need to appear on n0n's list for its operational data to be exposed through a terminal, EDI hub, agent or shared platform. Use this tool to identify where a counterparty-driven review should start.
No elevated shared-system indicators selected
Current selections do not indicate an obvious connection to the kinds of shared applications and data exchanges highlighted in the n0n research.
We welcome your feedback, suggestions, corrections, and ideas for enhancements.
Please click here to get in touch