A new post from SOCRadar reported that the n0n extortion group added 38 organizations across the global maritime and logistics sectors to its dark web leak site, raising concerns about potential exposure of port and shipping data. The listings span 18 countries and include container terminals, shipping lines, port IT providers, logistics companies, and related businesses. South Korea accounts for 12 of the 38 entries, including Busan terminal operators BNCT and Pusan Newport Company. The listed data reportedly includes vessel schedules, container manifests, gate movement records, shipping documentation, and terminal system configuration records.
The n0n group set a publication deadline of Oct. 19, 2026, at 13:27 UTC, with settlement demands reviewed by SOCRadar ranging from $2.4 million to $14 million. The small, application-scoped data sets and incomplete infostealer coverage across victims point to a likely shared entry point, such as an exposed shared application or vulnerability, rather than separate intrusions.
SOCRadar said the pattern of relatively small, narrowly scoped data sets and lack of infostealer credential matches for many listed organizations points to a possible shared application or vulnerability, rather than 38 separate network intrusions. The claims had not been publicly confirmed by any listed maritime organization at the time of the report, and SOCRadar cautioned that they remained unverified.
n0n is a financially motivated extortion group that emerged in September 2026 and monetizes stolen data through public leak postings. According to SOCRadar’s tracker profile, the group gains access using credentials harvested by infostealer malware, exfiltrates material such as Active Directory mappings and legal documents, and then pressures victims with dark web leak postings.
The profile notes that n0n avoids traditional ransomware deployment and instead manipulates victim data using administrative tools. However, its ATT&CK mapping still includes encryption and recovery-inhibition techniques, so defenders should not rule out disruptive impact. Until an encryptor is publicly tied to the group, n0n is best treated as a data-theft extortion operation with the access to cause damage.
Before the maritime wave, n0n’s victimology was broad and opportunistic. Its first 21 listings spanned investment firms, telecommunications, retail, education, and pharmaceuticals across 17 countries, including claims against Fanatics, Transcom WorldWide, AstraZeneca Türkiye, Argentina’s Ministry of Education, STOKR, and Venezuelan internet provider Inter. SOCRadar rates n0n near the top of its aggressiveness scale and near zero for lethality.
SOCRadar found that the detail pages behind the maritime listings point to a single exposed application or vulnerability rather than 38 separate network intrusions. The reviewed postings describe small, narrowly scoped data sets.
It revealed that Nam Dinh Vu Port did not state a claimed volume, but its listing includes 23,507 EDI message files. These contain vessel schedules, container manifests, gate movement records, and booking messages exchanged with multiple international shipping lines. ILCS Pelindo claimed 2.4 GB of data across 108 files. The data consists of EDI container manifest archives and operational records.
Furthermore, Pusan Newport Company claimed 1.5 GB across 774 files. The data includes container documentation, EDI shipping records, deployment material, and terminal system configuration records. Eurogate Tanger claimed 660 MB across 354 files. The data includes commercial configuration records, systems release documentation, and container and vessel records.
Also, BMT IQ claimed 90 MB across 18 files. The data includes commercial e-invoice records, equipment interchange receipts, and inspection records. EUSU Logistics claimed 60 MB across 41 files. The data includes infrastructure configuration and assessment records, as well as internal systems material.
SOCRadar provided three observations that support the theory of a shared entry point. The first concerns scale. Each reviewed listing presents its data as a complete archive or copy, yet volumes run from 60 MB to 2.4 GB and file counts from 18 to 774, which is the footprint of a single application’s data store rather than a compromised corporate network.
The second concerns content. The same narrow categories recur across countries and business types, including EDI messages, manifests, gate and equipment interchange records, terminal system configuration, release documentation, and deployment material. The third concerns access. SOCRadar checked stealer-log data for the domains of n0n’s victims and did not find credential matches for many of the listed maritime organizations. This means stolen credentials, which are n0n’s documented entry point, do not explain the batch.
SOCRadar mentioned that n0n’s leak site works as a public scoreboard. Every entry carries a status and a countdown, and the statuses tell victims, and everyone watching, how the group expects negotiations to go.
The post included an entry marked ‘Pending Exposure,’ which means the victim is anonymized as “Company #N,” with only a sector and location shown, and a publication date set one to three days out. An entry marked ‘Not Paid, exposed’ means the victim is named, with a publication date and countdown. An entry marked ‘Honored’ means the victim settled before its deadline, and one Canadian financial services company carries this label with a settlement date of Oct. 7, 2026.
Anonymized posting lets the group show a breach to the victim and hint at it publicly, while keeping room to negotiate before the name goes out. The ‘Honored’ label serves the opposite audience, because it advertises to future victims that paying works.
The maritime batch breaks from the group’s earlier rhythm. Instead of short, staggered deadlines, the maritime entries were posted with the victims named, and the ones reviewed share a single publication time of Oct. 19, 2026, at 13:27 UTC, which gives a seven-day window. A uniform deadline is consistent with a batch processed all at once, which supports the possibility of a common data source.
SOCRadar said n0n’s claims should be treated as unverified until data is published or a victim confirms. Of the 21 victims SOCRadar tracked before the maritime wave, 19 remain at the ‘Claimed’ stage, one is listed as negotiating, and one, Chibitek, has had data leaked.
Several factors cut both ways. On specificity, the maritime descriptions name concrete data types, such as bunker cost calculations, demurrage and despatch records, and port disbursement accounts, which are hard to invent convincingly at scale. On language, the entries follow an identical structure and phrasing, which suggests automated or generated write-ups and says little about the underlying access.
Two factors weigh toward caution. No listed maritime organization had publicly confirmed an incident at the time of writing. The group’s earlier high-profile claims, including those against Fanatics and Transcom WorldWide, had also not been publicly confirmed by the named companies at the time of writing. The October 19 deadline is the most useful test. Whether data appears, how much of it appears, and whether it matches the descriptions will show what n0n actually holds.
Any maritime or logistics organization that exchanges EDI with the companies named in the listings should plan for the possibility that its operational data appears in the Oct. 19 release, whether or not it is listed itself.
The first step is to map shared platforms. Organizations should identify which port community systems, EDI hubs, terminal system vendors, and file transfer services carry their data, and ask those providers directly whether they are investigating. They should also patch and review exposed interfaces by checking internet-facing EDI, file transfer, and terminal system components for outstanding security updates and for unexpected access or bulk downloads. As SOCRadar’s maritime OSINT guide shows, port management and cargo tracking systems can be discoverable on search engines such as Shodan.
Credentials and remote access also need attention. Organizations should rotate integration credentials for SFTP, AS2, VAN, and vendor support accounts used with EDI and terminal systems, starting with any shared or long-lived ones. They should check for infostealer exposure by searching for employee and vendor credentials in stealer logs, since n0n’s earlier access started there, and SOCRadar’s Dark Web Report is a free starting point. They should also close remote access gaps by enforcing MFA on VPN and RDP, removing internet-exposed RDP, and reviewing recent remote logins for unfamiliar sources.
Finally, organizations should prepare for counterparty exposure by drafting customer and regulator communications now, because data can leak through a partner’s or vendor’s breach even if their own network is clean. They should also track the group by following n0n’s activity and new postings on its SOCRadar group profile.
