The n0n ransomware group is pressing more than 30 port, shipping and logistics firms to pay, and most of the companies it has named have not confirmed a breach. The group, which Risky Business describes as relatively new, posted its first named victims on October 12. Its payment deadline passed on October 19, and threat-intelligence roundups published on October 23 reported that data from the listings had followed.
The batch counts 38 organizations across 18 countries, with 12 of them in South Korea, according to Provendata and Cypro. Risky Business counts 40-plus organizations and reports that the group moved from one maritime IT services provider's network into port authorities, maritime companies and sea-shipping firms. The newest coverage is from October 23, so this is a follow-up to an October 12 posting rather than a new breach.
How the n0n ransomware leak campaign unfolded
The group changed its approach once it began naming names. Provendata reports that n0n first listed companies anonymously on October 5, but the October 12 batch published victim names from the start. Extortion-only groups often publish names before proving access, betting that reputational pressure will produce a payment, according to Tech Insider.
| Date (2026) | Event |
|---|---|
| Oct. 5 | n0n posts anonymous listings without victim names |
| Oct. 12 | First named batch of victims goes up on the leak site |
| Oct. 19, 13:27 UTC | Payment deadline passes |
| Oct. 23 | Threat-intelligence roundups report that most victims refused to pay and had data published |
After the deadline, Cyware reported that most victims refused to pay and had their data published on the site. The reviewed coverage contained no leaked files and no victim statements, so the publication claim rests on threat-intelligence reporting rather than on a copy of the data.
Which port and shipping firms appear on the list
Most of the named victims are terminal and port operators, shipping lines, logistics firms and port IT providers, according to Provendata. A single container can pass through a terminal operator, a carrier and a freight forwarder, so one compromised data set can touch several of those companies at once. That interdependence is why the list matters beyond the companies named on it.
As of mid-October, none of the named organizations had publicly confirmed a breach, according to Cypro and Cyware. Silence settles nothing in either direction, and forensic reviews take time.
Is CyberLogitec the shared entry point
Security firm CyDome says about half of the listed companies are known customers of CyberLogitec, a South Korean maritime IT platform vendor. CyberLogitec's website has also been down for weeks, according to the same Risky Business report. That overlap is the strongest lead in the public reporting, but it is not proof.
Warbrief says analysts see the overlap as a sign of a shared entry point, not a confirmed supplier compromise. The distinction matters. If the group reached dozens of customers through one vendor, the response starts with that vendor's access controls and logs. If each victim was breached separately, the fix looks very different.
This pattern is the core risk of supply-chain intrusions. One platform with broad access to customer systems can hand an attacker dozens of targets at once. Our earlier coverage of the Gheist campaign, which used stolen GitHub tokens to dump repository secrets, shows the same logic from the developer side: one stolen credential can reach many downstream systems.
How much n0n is asking and why the numbers do not add up
Risky Business reports a combined demand of $1.2 billion. Cypro, relaying figures from SOCRadar, puts individual demands at about $2.4 million to $14 million, payable in Bitcoin. Provendata offers two concrete examples: one logistics firm was asked $14 million for 60 MB of data, and an Indonesian port logistics provider was asked $2.4 million for 2.4 GB.
The examples show a wide spread. Pricing appears to track the victim's size and ability to pay rather than the volume of stolen data, since the 60 MB haul carried a far higher price than the 2.4 GB one. That pattern is an inference from two examples, not a documented rule.
The totals do not reconcile neatly. At $2.4 million to $14 million each, 38 firms would owe roughly $91 million to $532 million, well short of $1.2 billion. Either some demands sit above the reported range, the victim count is higher than 38, or the total includes figures the sources do not explain. The reviewed reporting does not resolve the gap.
The claimed haul includes EDI messages, shipping manifests, gate and equipment-interchange records, and terminal-system configuration data, according to Tech Insider and Warbrief. Those records reveal cargo movements and routing, which are commercially sensitive and could help someone plan a disruption. Risky Business also notes that if the group's numbers hold, it would have ranked as the third-most active ransomware group in Q3, behind Qilin and The Gentlemen. Attribution confidence is rated low, and no public decryptor exists, so victims depend on their own backups and incident response rather than a free tool.
Why US importers, exporters and freight firms should care
No US victim had been confirmed in the reviewed sources. Warbrief cites Americas-region victims, mainly in Brazil, and 12 of the 38 listed organizations are in South Korea. US exposure is therefore indirect, but it is not hypothetical.
Three groups of US readers are most directly affected: companies that import or export through foreign ports, US logistics and freight firms that book cargo through those ports, and any US business that relies on third-party maritime or EDI platforms. A disruption at a foreign terminal can delay a US shipment without the US company ever being breached. Shipping and ports depend on networked systems to move cargo, which raises the stakes of any outage, according to Tech Insider.
Ransomware that halts systems people rely on shows how quickly disruption spreads. Our report on the attack that left Columbia, South Carolina city services offline illustrates the point for a municipal setting.
What US companies should check this week
The steps below are general guidance for business owners and IT teams, not recommendations drawn from a cited advisory. Consumers have no direct action to take on this story.
- Ask logistics, freight and EDI vendors in writing whether they use CyberLogitec or a similar maritime platform, and what they have checked.
- Review who can access shared port, EDI and freight portals, and remove accounts that no longer need access.
- Rotate passwords, API keys and integration credentials that connect to those platforms. Our Railway breach story explains why exposed keys should be rotated immediately.
- Confirm that backups of shipping-document and manifest systems are offline or otherwise isolated, and test a restore before you need one.
What to watch next
Three signals will shape how this story develops. The first is whether CyberLogitec or another shared vendor is confirmed as the entry point, which remains a suspicion rather than a finding. The second is whether any named company confirms a breach, disputes its listing or sends customer notices. The third is whether the batch grows past 38, and whether the 40-plus figure Risky Business reports holds up under scrutiny.
A confirmed vendor compromise would widen exposure to every customer on that platform and push other maritime firms to audit their own suppliers. A clean forensic result would point investigators back toward individual victims, and the campaign would look more like a string of separate incidents. Either outcome would change what port operators and logistics buyers ask their vendors this quarter.
