A data-theft extortion group called n0n listed 38 port operators, shipping lines, port IT providers and logistics companies in 18 countries on its leak site on Oct. 12 and set an Oct. 19 deadline to release the data, according to threat intelligence firm SOCRadar. SOCRadar said the payment demands it reviewed range from $2.4 million to $14 million in bitcoin. The group’s claims have not been independently verified, and none of the named organizations had publicly confirmed a breach as of Oct. 14, according to The Loadstar, Splash247 and The Maritime Executive. Those named include Ocean Network Express, Santos Brasil, and Busan terminal operators BNCT and Pusan Newport Co. SOCRadar did not identify any of the 38 as U.S.-based or as trucking companies.
SOCRadar said samples it reviewed included EDI messages, container manifests, booking messages, vessel schedules and gate movement records. Because the datasets are small and similar across unrelated companies, the firm assessed that they likely came from a single shared application, EDI integration or file transfer platform rather than 38 separate intrusions, and warned that exposure could extend to organizations not on the list. Maritime cybersecurity firm Cydome said its assessment points to a possible compromise of a shared environment associated with maritime software provider CLT. Neither firm has confirmed the source.
Shipment-level data is a common starting point for cargo theft. In an August case, Manhattan prosecutors alleged that a ring charged with stealing about $4.49 million in goods won load bids using shipment information obtained through hacks by other groups. SOCRadar advised companies that exchange EDI with the listed firms to ask their vendors whether they are investigating, rotate shared integration credentials, and require multifactor authentication on remote access.
Sources
- SOCRadar: n0n Group’s October 2026 Maritime Leak Batch
- The Loadstar: Cyber-crime group hits 38 shipping and port groups with data leak threat
- Splash247: Shipping firms and ports caught in mass cyber extortion claim
- The Maritime Executive: Massive cyber attack threatens release of data from 38 maritime companies
- Transport Topics: Grand jury indicts 8 in cargo theft scheme tied to hacked data
