Maritime Cyber Attack: 38 Firms Face Leak
Introduction
On 12 October 2026, the cyber extortion group n0n posted a list of 38 shipping, port and logistics organisations to its data leak site, demanding US$2.4–14 million in Bitcoin before releasing the purported stolen information. The batch covers entities across 18 countries, including major players such as Ocean Network Express, T.S. Lines and Samudera. While no official confirmation of a breach has been received as of 14 October, the timing of the leak creates immediate pressure on maritime supply chains that rely on shared digital infrastructure.
Container terminals and port facilities form the digital and physical backbone of global shipping — and the infrastructure now under threat from data extortion groups targeting the maritime sector.
What Happened
On 12 October 2026, n0n added 38 organisations from the maritime ecosystem to its data leak site. The list includes shipping lines, container carriers, ports and terminal operators, with a notable concentration of organisations in South Korea. Named shipping lines include Ocean Network Express (ONE), T.S. Lines, Samudera Logistics International, and CULines, with South Korean entities forming a significant portion of the list. Port operators such as Santos Brasil, Portonave, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger and NEOM Ports were also identified. The simultaneous posting of 38 maritime entities has raised the possibility that one shared application or integration environment exposed information relating to multiple organisations, which could explain why 38 maritime entities appeared in a single batch without requiring 38 entirely separate intrusions from independent threat actor infrastructure.
Container ships like those operated by Ocean Network Express and other listed firms carry cargo worth billions across oceans, and their digital systems — manifest data, berth schedules, gate movements — are now targets for extortion groups.
How It Works
The n0n campaign operates by posting victim lists to a public leak site with a countdown deadline. In this case, the listed entities face a publication deadline of 19 October 2026 at 13:27 UTC. SOCRadar reported that ransom demands are attached to the listings, ranging from approximately US$2.4 million to US$14 million, payable in Bitcoin. The group may then stage and exfiltrate accessible information before applying pressure through public leak listings. Early reporting also associates its activity with legitimate remote administration tools and Remote Desktop Protocol rather than sophisticated custom ransomware, suggesting the exploitation method may involve less technically complex but equally effective attack vectors.
As of 14 October 2026, the maritime cyber attack claims had not been confirmed by the listed organisations, and no victim has published a technical incident report establishing a confirmed breach with an established technical cause. The threat actors have made their presence known through the public leak site and deadline announcement, but the actual capability to exfiltrate and authenticate the claimed data remains unverified. The ransom demands themselves, while potentially accurate descriptions of n0n's standard pricing model, cannot be used as definitive proof of successful penetration without supporting evidence such as exfiltration logs, data samples, or third‑party verification from the alleged victims.
Independent reporting by SOCRadar documented the n0n listings and ransom demands attached to them. This kind of analysis provides corroborating evidence of the threat actor's operations without relying solely on the extortion group's own claims.
Why This Matters
Maritime data flows through a dense web of digital interfaces—EDI exchanges between carriers and terminals, port terminal systems, vessel scheduling platforms, and logistics coordination tools that connect thousands of entities worldwide. These systems process millions of transactions daily, creating a massive attack surface for cyber criminals. A breach at one participant can cascade across the entire system, exposing information about organisations that were not directly compromised. UK freight forwarders, importers, and smaller logistics businesses may have shipment or account data held in partners' systems, meaning a single compromised entity could inadvertently expose downstream organisations to fraudulent communications, convincing payment requests based on genuine commercial relationships, or phishing messages that leverage real business contexts.
Unlike previous incidents that focused on isolated vulnerabilities or single‑organisation compromises, this attack touches shipping lines, ports, terminals, and the broader logistics ecosystem—highlighting the systemic fragility of global trade infrastructure. The maritime sector's heavy reliance on legacy systems, interconnected applications, and third‑party service providers creates unique security challenges that differ from the more familiar enterprise IT environments that security teams typically protect.
Risk Assessment
The lack of confirmation from victim organisations as of 14 October 2026 does not prove the claims are false. It means organisations should distinguish carefully between a public criminal allegation, evidence of data possession, and a verified breach with an established technical cause. The threat actors have made their presence known through the public leak site and deadline announcement, but the actual capability to exfiltrate and authenticate the claimed data remains unverified.
No victim has published a technical incident report establishing how n0n allegedly entered its environment. There is also no associated CVE, security patch, or proof‑of‑concept exploit published to date. Organisations should not infer that a particular platform is vulnerable solely from the structure of the leak‑site claims or from assuming that the presence of a company name on a leak list indicates a successful breach.
The CISA KEV catalog records actively exploited vulnerabilities across enterprise infrastructure, and its methodology highlights how government-tracked exploitability differs from unverified leak‑site claims — CISA provides authoritative context for vulnerability prioritisation.
What Organisations Should Do
Organizations operating in the maritime supply chain need immediate defensive action while maintaining an evidence‑based approach to avoid unnecessary disruption. First, review any shipping, port or logistics partners belonging to you, your subsidiaries, or your key data consumers for direct or indirect exposure to the 38 listed entities. Second, audit EDI feeds, container manifests, vessel scheduling systems, and gate movement records for unauthorized access or unusual activity that might indicate an ongoing intrusion or data exfiltration. Third, rotate all credentials that may have been exposed—this includes any npm tokens, GitHub tokens, AWS keys, Vault secrets, Kubernetes service account tokens, SSH keys, .env files, and MCP configuration files that the affected machine or service account could access.
Monitor for unusual GitHub Actions workflows, unexpected Sigstore provenance attestations, and anomalous API calls from developer accounts that show patterns consistent with the described exfiltration techniques. Review remote access and application account activity specifically looking for unusual logins from unexpected geographic locations, bulk downloads or data exports at unusual times, unexpected transfers of large data sets, or newly created administrator accounts that were not recently provisioned by IT staff. Prepare to assess any data published after the stated deadline to identify employees, customers, or shipments that may require notification, breach response procedures, or additional security controls. Critical monitoring should remain evidence‑led rather than making assumptions based solely on the leak site listing, and the priority is to investigate relevant connections, preserve logs, and prepare for credible downstream notifications rather than making unsupported assumptions about a particular product vulnerability or compromised system.
References
- CyPro, "Maritime Cyber Attack: 38 Firms Listed," 14 October 2026. https://cypro.co.uk/insights/cyber-bulletins/maritime-cyber-attack-38-firms-face-leak/
- SOCRadar, "Analyzing n0n's Maritime Extortion Listings," 13 October 2026. https://www.socradar.com/
- CISA, "CISA Adds Four Known Exploited Vulnerabilities to Catalog," 14 October 2026. https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
- The Maritime Executive, "Understanding Maritime Cyber Risk," October 2026. https://www.themaritimeexecutive.com/
- International Maritime Organization (IMO), "Cyber Risk Management Guidelines," 2024 update. https://www.imo.org/