Cyber Extortion Group Targets 38 Maritime Organizations

A newly emerged cyber extortion group has threatened to release data it claims to have stolen from 38 maritime and logistics organizations unless the companies pay multimillion-dollar ransoms.

The group, known as n0n, posted the names of the organizations on a dark web leak site October 12, according to cybersecurity firm SOCRadar. The organizations include shipping lines, port and terminal operators, logistics companies and maritime-related businesses across 18 countries.

Among the companies named were Ocean Network Express, CULines, T.S. Lines, Santos Brasil, TTI Algeciras and Eurogate Tanger. South Korea accounted for 12 of the organizations listed.

SOCRadar reported that the group was seeking ransom payments in Bitcoin, with individual demands reportedly ranging from $2.4 million to $14 million. The group set an October 19 deadline for payment before threatening to publish the information it claims to possess.

The companies named in the leak had not publicly confirmed the alleged breaches in the initial reporting. Cybersecurity researchers have cautioned that being listed by the group does not necessarily mean an organization’s own network was compromised.

The incident also raised concerns about the potential role of shared maritime technology systems. Cydome, a maritime cybersecurity company that analyzed the listings, said its preliminary assessment indicated the data may have originated from a shared environment associated with CyberLogitec, a maritime software and information technology (IT) services provider. At least 21 of the 38 organizations were identified as publicly documented CyberLogitec customers, according to Cydome.

Cydome said the available information suggested the alleged data could include EDI traffic, system documentation, commercial records, personal information and credentials. It emphasized that the source and scope of the alleged breach remained unconfirmed.

The potential connection to a shared vendor system highlights the cybersecurity risks associated with interconnected maritime technology networks. Cydome recommended that maritime operators review third-party vendor access, assess supplier exposure and examine credentials shared through support channels.

The n0n group first emerged in September and has previously claimed attacks against organizations in industries including telecommunications, retail, education and pharmaceuticals. Researchers have characterized its activity as data-theft extortion rather than traditional ransomware, in which attackers encrypt a victim’s systems and demand payment for decryption.

The latest incident is part of a broader series of cyberattacks affecting the maritime industry, including attacks that have disrupted shipping-line booking systems and port terminal operations.