Extortion group names 38 shipping and port firms, sets 19 October deadline

38 shipping names, one deadline, and a shared weak point forwarders plug into every day
An extortion group called n0n has named 38 organisations from the global shipping and ports sector on its dark-web leak site. A leak site is a public page where criminals list victims and threaten to publish stolen data unless they are paid. According to cybersecurity firm SOCRadar, reported by The Loadstar on 14 October, the 38 names went up in a single batch on 12 October. They span 18 countries. Ransom demands range from $2.4m to $14m, payable in bitcoin. The deadline for publication is 19 October at 13:27 UTC.
At the time of The Loadstar’s report, none of the named maritime organisations had publicly confirmed a breach. Every claim is unverified.
Our view: forwarders should not read this as 38 separate break-ins at 38 big companies far away. The more likely story is a single shared system that many carriers, terminals and logistics firms connect to. Forwarders connect to those same systems every day. That puts forwarders closer to this than the list of names suggests.

Who is on the list

The Loadstar’s list of named organisations reads like a map of the world’s container trade.

• Carriers: ONE (Ocean Network Express, Singapore), CULines (China) and TS Lines (Taiwan).
• Terminals in South Korea: BNCT and Pusan Newport Co in Busan. South Korea accounts for 12 of the listings.
• Terminals in Brazil: Santos Brasil, Portonave and Superterminais.
• Terminals elsewhere: TTI Algeciras in Spain and Eurogate Tanger in Morocco.
• Logistics and port IT: EUSU Logistics (South Korea) and ILCS Pelindo (Indonesia).

SOCRadar’s public tracker page for n0n, last updated on 12 October, adds names from the same wave. Among them are crane maker ZPMC (China), NEOM Ports (Saudi Arabia), Asyaport (Turkey), HPC Hamburg Port Consulting (Germany) and Yusen Logistics Hong Kong. That last one is a forwarder. Forwarders are not just neighbours to this problem. One of them is already on the list.

Why we think it is one door, not 38

The strongest evidence comes from SOCRadar itself. The firm said the pattern of data described in the listings suggested “a possible common point of entry,” “rather than 38 separate network intrusions.” It added a warning: “a shared system could extend the potential exposure beyond the organisations named on the leak site.”
Look at what the samples contain. The Loadstar says reviewed samples included EDI messages, container manifests, vessel schedules, gate movements and terminal system configuration records. EDI (electronic data interchange) is the machine-to-machine messaging that moves bookings, bills of lading, container status and customs data between carriers, terminals and forwarders. A gate movement is the record of a box entering or leaving a terminal. This is the kind of data that sits on port community systems, EDI hubs and file-transfer services. A port community system is a shared platform where everyone in a port exchanges cargo data. These are the systems that many parties plug into. They are less likely to be the private servers of one company.
There is another clue. n0n’s usual method, according to SOCRadar’s group profile, is “compromised credentials from third-party infostealer malware”. Infostealer malware sits on a staff member’s computer and harvests saved passwords. But The Loadstar reports that SOCRadar did not find matching infostealer credential records for many of the listed companies. That makes the stolen-password explanation harder to support. It leaves a shared application or integration platform as the more likely route.
SOCRadar said the pattern is “reminiscent of mass-exploitation campaigns involving file-transfer software vulnerabilities,” “including the MOVEit Transfer attacks in 2023 and Cleo in 2024.” In both of those cases, one flaw in widely used file-transfer software exposed hundreds of organisations at once. SOCRadar found no evidence that n0n is linked to those campaigns. The comparison is about shape, not authorship.
The ransom figures also look odd. They do not track the amount of data. EUSU Logistics faces a $14m demand for about 60MB. ILCS Pelindo faces $2.4m for about 2.4GB. That is forty times the data for one-sixth of the price. Some listings also offered victims the option of opening negotiations after paying 10% of the demand. To us, that looks like a group pricing each victim by what it thinks the victim can pay. It does not look like a group pricing what it actually holds.

Who n0n is

n0n is new. Fortra, a cybersecurity firm, wrote on 2 October that the group was first spotted in mid-September 2026. Within days it had posted about a dozen alleged victims. Its unconfirmed claims include outsourcer Transcom, Venezuelan internet provider Inter and sports retailer Fanatics. The Loadstar says the group had 21 victims across telecoms, retail, pharmaceuticals and education before this batch. The maritime wave more than doubled that count.
Researchers do not agree on exactly what kind of group this is. The Loadstar, drawing on SOCRadar, describes n0n as a “financially motivated data-theft extortion operation”. In other words, it steals data and sells silence rather than locking up systems. But The Loadstar notes that SOCRadar’s profile “nevertheless includes techniques associated with encryption and interference with recovery”. Fortra also reports that the group claims to shut down victims’ networks and destroy backups, though it advises caution about those claims. So disruption cannot be ruled out, even if theft is the main game.
The track record so far suggests patience is needed. Of the 21 earlier victims, The Loadstar reports, 19 were still at the “claimed” stage, one was negotiating, and only one, Chibitek, had seen data leaked. A name on a leak site is an accusation, not proof of a breach.

What happened last time a port system went down

Data theft is bad. Operational outage is worse, and shipping has seen it before.
In November 2023, a cyberattack on DP World Australia forced the shutdown of its terminals in Melbourne, Sydney, Brisbane and Fremantle. Bloomberg, republished by gCaptain, reported that “DP World manages almost 40% of goods flowing in and out of Australia”. It also said the company was “struggling to work through a backlog of 30,000 shipping containers piled up at ports across Australia”. On the Monday after the attack, DP World expected to move only 5,000 boxes out of the four ports, less than a quarter of normal daily national volume.
That attack hit one operator in one country. The n0n list covers carriers and terminals on three continents. If n0n’s encryption techniques were ever used against a shared system rather than just its data, the knock-on effects would be wider. Bookings, gate appointments and release messages could all stall.
We are not predicting that. Data theft is the most likely outcome here. But forwarders should plan for the less likely case too.

What forwarders should do this week

The exposure for forwarders comes in three layers.
First, your data may already be in the haul. If a carrier, terminal or EDI hub you work with was breached, your bookings and your shippers’ names, consignees, commodities and contact details may be in those manifests and EDI files. Under data protection rules in many countries, you may have duties to your own customers even when the breach happened somewhere else.
Second, phishing. Leaked booking data makes fake emails very convincing. A message that quotes a real container number, vessel and consignee is easy to trust. Expect fake invoices and “updated bank details” emails aimed at your accounts team in the weeks after 19 October.
Third, disruption. If any named terminal or carrier has to take systems offline to clean up, gate slots and EDI status messages could be delayed.
SOCRadar’s recommendations, as reported by The Loadstar, translate into a short to-do list:

• List the port community systems, EDI hubs and file-transfer services that carry your data. Ask each provider directly whether it has been affected.
• Rotate integration credentials: the passwords, keys and tokens your systems use to talk to carriers’ and terminals’ systems.
• Check for compromised staff and supplier credentials.
• Enforce MFA (multi-factor authentication, a second login step such as a code on a phone) on all remote access.
• Remove any RDP (remote desktop protocol) service exposed to the open internet.
• Prepare a customer and regulator notice now, so you are not writing it under pressure later.

Add one step of our own. Brief your accounts team today. Any request to change payment details after 12 October should be confirmed by phone, using a number you already had.

Our call

Our prediction is that 19 October passes with data from at least one maritime listing published. By 31 October, at least one of the 38 named organisations will publicly confirm a security incident. We also expect a shared software, EDI or file-transfer platform to be named as the common entry point before the end of November. When that happens, the list of affected companies will grow beyond the 38, and some of the new names will be forwarders. Forwarders who have already rotated their keys and briefed their customers by then will lose the least time and trust.

Sources

• \
• The Loadstar — Cyber-crime group hits 38 shipping and port groups with data leak threat, 14 Oct 2026 \
• SOCRadar — Ransomware Intelligence: n0n, updated 12 Oct 2026 \
• Fortra — n0n Ransomware: What You Need to Know, 2 Oct 2026 \
• gCaptain (Bloomberg) — Australia Cyberattack Leaves 30,000 Containers Stuck at Ports, 13 Nov 2023