Key points
- The n0n group listed 38 maritime and logistics organizations on its dark web leak site.
- SOCRadar analysis suggests a shared application vulnerability may be the entry point rather than separate breaches.
- Settlement demands range from $2.4 million to $14 million with a publication deadline set for October 2026.
The n0n extortion group has added 38 organizations in the maritime and logistics sectors to its public leak portal, according to a report by SOCRadar. This listing includes container terminals, shipping lines, port IT providers, and related businesses across 18 different countries. South Korea represents the largest share with 12 entries, including operators for the Busan terminal.
By the numbers
- 38 maritime and logistics organizations are listed on the n0n leak site.
- 18 countries are represented among the targeted organizations in this campaign.
- $2.4 million to $14 million is the reported range for settlement demands.
What the figures mean
The data exposed reportedly includes vessel schedules, container manifests, gate movement records, shipping documentation, and terminal system configuration files. SOCRadar noted that the data sets are small and narrowly scoped, with incomplete infostealer coverage across victims. This pattern suggests the group likely exploited a shared application or vulnerability, rather than conducting 38 separate network intrusions.
n0n is a financially motivated group that emerged in September 2026. According to its tracker profile, the group typically uses credentials harvested by infostealer malware to access Active Directory mappings and legal documents. While n0n avoids traditional ransomware deployment, its tactics include encryption and recovery-inhibition techniques. Defenders should treat it as a data-theft operation with the potential to cause disruptive damage.
What should you do?
Managed service providers should immediately verify if their maritime clients appear on the n0n leak site. Check internal logs for indicators of compromise related to infostealer malware or unusual administrative tool usage. Review access controls for shared applications that connect multiple organizations, as these may be the common entry point. Monitor for any unauthorized changes to terminal system configurations or shipping documentation.
Operational impact
Security teams should determine which clients operate within the affected maritime and logistics sectors. Identify any shared cloud applications or third-party platforms that could serve as a common breach vector. Notify affected clients about the potential exposure of operational data like vessel schedules and container manifests. Coordinate with legal counsel to assess liability risks associated with leaked port data. Establish a communication plan to address client concerns regarding data integrity and service continuity.
What to do and how to stay safe: n0n
- Verify if your organization or clients are listed on the n0n leak site.
- Audit shared applications for unauthorized access or configuration changes.
- Monitor for signs of infostealer malware activity in network logs.
- Prepare incident response plans for potential data exfiltration events.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which countries are most affected by the n0n maritime leak campaign?
The listings span 18 countries, with South Korea accounting for 12 of the 38 entries.
What type of data was reportedly exposed by the n0n group?
Exposed data includes vessel schedules, container manifests, gate movement records, and terminal system configurations.
How did the n0n group likely gain access to these organizations?
Analysis suggests a shared application vulnerability or exposed shared application rather than separate intrusions.
