38 shipping and port firms face a leak deadline on 19 October

One software hole, 38 victims: why the n0n leak is a forwarder problem
On 12 October, a cyber extortion group called n0n added 38 shipping lines, port terminals and logistics firms to its leak site in a single batch. That is according to SOCRadar, a threat intelligence firm that tracks these sites. A leak site is a page on the dark web where criminals name victims and threaten to publish stolen data unless they are paid.
The 38 span 18 countries, SOCRadar says. Twelve are in South Korea. The group has set a publication deadline of 13:27 UTC on Monday 19 October. Its demands range from $2.4m to $14m, payable in bitcoin.
The named firms include Ocean Network Express (ONE), CULines, TS Lines and Samudera among carriers. Terminal names include BNCT and Pusan Newport in Busan, Santos Brasil, Portonave and Superterminais in Brazil, TTI Algeciras in Spain, Eurogate Tanger in Morocco, Nam Dinh Vu Port in Vietnam and NEOM Ports in Saudi Arabia. Indonesian port IT provider ILCS Pelindo and Korean forwarder EUSU Logistics are also on the list.
None had publicly confirmed a breach when The Loadstar and Splash247 reported the claims on 14 October. Every claim is unverified.
Our view is simple. This does not look like 38 hacks. It looks like one. And the data at stake is not mainly the carriers’ or terminals’ own. It is the shipping data that forwarders and their customers send through them every day.

Why it looks like one breach

SOCRadar’s own reading points the same way. It says the detail pages behind the listings point to “one exposed application or vulnerability rather than 38 separate network intrusions.”
Three things support that.
First, the data is narrow. SOCRadar says the same few categories repeat across countries and business types: EDI messages, manifests, gate and equipment records, terminal system settings and release documents. EDI, or electronic data interchange, is the standard file format companies use to swap bookings, bills of lading, manifests and container status messages. A gang that had broken into 38 separate corporate networks would usually grab email, finance and HR files. This haul looks like what you would pull from one system that sits between many companies.
Second, the files are small. SOCRadar lists volumes from 60MB to 2.4GB. ILCS Pelindo’s listing is 2.4GB across 108 files. Pusan Newport’s is 1.5GB across 774 files. Eurogate Tanger’s is 660MB across 354 files. EUSU Logistics’ is 60MB across 41 files. For Nam Dinh Vu Port, SOCRadar counts 23,507 EDI message files. Those are the sizes of a data export, not a full network theft.
Third, the batch arrived all at once. SOCRadar says n0n had 21 victims across 17 countries as of 8 October, spread across telecoms, retail, pharmaceuticals and education. Four days later it more than doubled that count with a single maritime drop.
SOCRadar compares the pattern to past mass attacks on file transfer software, MOVEit Transfer in 2023 and Cleo in 2024. In those cases, it says, “a flaw in one widely deployed file transfer product produced a long list of victims.” It is careful to add: “There is no evidence linking n0n to those campaigns.”
Splash247 adds a name. It reports that maritime cyber security firm Cydome has pointed to a possible link to software supplied by CyberLogitec, a company that sells terminal operating and shipping software. Cydome stressed it has not established the origin or extent of any breach. SOCRadar’s write-up does not name any vendor. That link is a lead, not a finding.

What the gang wants, and how it sells

SOCRadar calls n0n a “financially motivated data-theft extortion group”. It says the group appeared in September 2026. The Loadstar, citing SOCRadar, notes it usually avoids classic ransomware, which locks up systems, though its methods can include encryption and interfering with recovery.
The prices are odd. EUSU Logistics was asked for $14m for 60MB of data, according to SOCRadar. ILCS Pelindo was asked for $2.4m for 2.4GB. Price does not follow volume. It seems to follow what the gang thinks the victim can pay, or how much harm it thinks publication would cause.
Some listings offer a negotiation room after a 10% down payment. SOCRadar says Eurogate Tanger faces a $6m demand with an entry fee of 5.7 BTC, about $600,000. ILCS Pelindo’s entry fee is 2.3 BTC, about $240,000.
The group also uses its site as an advert. SOCRadar says one earlier victim, a Canadian financial services firm, carries an “HONORED” label after settling before its deadline. In SOCRadar’s words, the label “advertises to future victims that paying works.”
What usually happens next? Of n0n’s 21 earlier victims, SOCRadar says 19 remained at the “claimed” stage, one was negotiating and one, Chibitek, had its data leaked. So the record so far is mostly threats. But this batch is bigger and more targeted, and the deadline is days away.

Why forwarders should care

Think about what sits in a container manifest or an EDI booking message. The shipper. The consignee. The notify party. The commodity and its description. Container numbers. Port pairs and vessel. Often the forwarder’s own name as the booking party.
That is your client list and your trade lanes in one file.
If it is published, three risks follow, in our view.
The first is fraud. Criminals who know a real shipment, a real container number and a real consignee can send a very convincing fake invoice or “updated bank details” email.
The second is cargo theft. Gate movement records and vessel schedules show when a box leaves a terminal and where it is heading. Paired with commodity data, that helps thieves pick high-value loads.
The third is commercial. Rivals, or anyone who buys the dump, can see who ships what, with whom, on which lanes.
There is also a paperwork question. If your clients’ data sits in a leaked file from a carrier or terminal, some will ask whether you need to tell them. Data protection rules differ by country. But the question will come, and it will land on the forwarder, because you are the one the shipper deals with.
SOCRadar’s advice to the wider industry is blunt: “Listed or not, any organization that exchanges EDI with the companies above should plan for the possibility” that its own data is in the haul. It tells firms to map which port community systems, EDI hubs and file transfer services handle their data. It also says to check with those providers, rotate integration passwords and keys, turn on multi-factor log-in for remote access, and prepare customer messages in case a third party is exposed.

What happened last time a port was hit

Shipping has been here before, though not at this scale.
In November 2023, DP World Australia, which BleepingComputer says handles about 40% of the country’s container trade, cut its network from the internet after a cyber attack detected on 10 November. BleepingComputer reports the attack disrupted land-side freight operations at five ports. Ports reopened on 13 November. By 20 November, the company said it had “cleared 100% of the backlog, comprising some 30,137 containers.”
DP World later confirmed that “a small amount of data was exfiltrated,” including personal information of current and former staff. It said “no ransomware was found or deployed within the DP World Australia network.” It said customer data was not affected.
That case was about stopped trucks and stuck boxes. The n0n claims are different. Nothing has stopped, as far as anyone has reported. The risk is quieter. Data leaks out, and the harm comes later, through fraud and theft that is hard to trace back to the source.

What we expect

Our reading is that the weak point is the plumbing between companies, not any single carrier or terminal. That is where forwarders sit. Most forwarders connect to carriers and terminals through EDI feeds, booking portals and community systems. If one shared platform was the door, every company plugged into it is exposed. That includes companies not on the list.
For lanes, we do not expect physical disruption from this. Ships will sail and gates will open. The cost shows up in admin: credential resets, client questions, extra checks on payment requests, and slower onboarding of new EDI links while carriers and terminals check their suppliers.
Here is what we think forwarders should do this week. Ask your account contacts at any listed carrier or terminal whether they have checked their EDI and portal providers. Change the passwords and keys on any EDI or API link to those firms. Tell your finance team to phone-check any bank detail change linked to these carriers or ports. And draft a short note to clients now, so you are not writing it in a hurry after Monday.
Our predictions. First, n0n will publish data for at least some of the 38 on or within a week of the 19 October deadline. Its record of leaving most victims at “claimed” will not hold for a batch this size. Second, within four weeks, at least one named carrier or terminal, or a software supplier, will publicly confirm an incident tied to a shared system. Third, by the end of November, at least one big carrier or terminal group on the list will require partners to reset EDI or portal credentials. Expect phishing emails that quote real container numbers from these firms before the end of Q4.

Sources

• \
• The Loadstar — Cyber-crime group hits 38 shipping and port groups with data leak threat, 14 Oct 2026 \
• Splash247 — Shipping firms and ports caught in mass cyber extortion claim, 14 Oct 2026 \
• SOCRadar — n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site, 13 Oct 2026 \
• DP World — Media Statement: Update on Cybersecurity Incident, 28 Nov 2023 \
• BleepingComputer — DP World confirms data stolen in cyberattack, no ransomware used, 2023