n0n Group Extorts 38 Maritime Companies, Demanding Up to $400 Million

On October 12, the cyber extortion group n0n listed 38 maritime and logistics companies and organizations across 18 countries on its dark web site, demanding a ransom ranging from $400,000 to $400 million per company, with a unified deadline ending October 19 at 13:27 UTC.

The list included container line companies, terminal and port operators, logistics firms, ship managers, and agents, including Ocean Network Express, Pusan Newport, Santos Brasil, TTI Algeciras, Eurogate Tanger, NEOM Ports, and ZPMC. Total ransom demands reached approximately $1.22 billion, according to an analysis by cybersecurity firm Cydome.

Cydome estimated that the stolen data may originate from a single support and projects archive linked to Korean company CyberLogitec, which provides software and tech services to maritime firms. It stated that at least 21 of the 38 companies are publicly documented clients of the firm, and that filenames in seven other listings point to it or its products.

It explained that the published samples include credentials, personal information, EDI message traffic, and system documents, with file dates ranging from 2009 to August 2026. It stressed that listing a company does not necessarily mean its private network was breached.

What do these terms mean?

Cyber Extortion: Threatening to publish stolen data unless a company pays a sum of money or fulfills a specific request.

EDI: Electronic data interchange of standard business messages between shipping companies, ports, and customs without human intervention.

Dark Web Site: A website that does not appear in search engines and is used to display stolen data or illegal activities.