The financially motivated extortion group n0n posted 38 organisations on its dark-web leak site on 12 October, nearly all of them in ports, shipping and logistics, and set a common publication time of 19 October at 13:27 UTC. The working primary for the inventory is SOCRadar’s 13 October analysis of that batch. The Maritime Executive carried the sector read on 14 October. Cydome’s 14 October warning, as reprinted by Digital Ship and World Ports, assessed a possible compromise of a shared environment associated with the maritime software provider CyberLogitec, also printed as CLT, and counted 37 organisations on the list it reviewed. Port News restated the SOCRadar clock on Thursday, 15 October. None of the named maritime organisations had publicly confirmed a breach. The claims remain unverified. This is a vendor-and-EDI exposure file. It is not a confirmed CyberLogitec incident, not a named ONE outage, and not a rewrite of Singapore’s MPA cybersecurity bill or of last week’s CIRCIA reporting piece.
SOCRadar describes n0n as a data-theft extortion operation that emerged in September 2026, likely based in Russia. Before this maritime wave it had posted 21 organisations across investment, telecommunications, retail, education and pharmaceuticals in 17 countries. It typically avoids deploying a traditional encryptor and instead pressures victims with leak-site postings. Its ATT&CK mapping still includes encryption and recovery-inhibition techniques, so a DPA should not assume the only risk is publication. Until an encryptor is publicly tied to the group, treat it as theft-and-extortion with the access to cause damage. SOCRadar rates the actor high on aggressiveness and near zero on lethality. That rating is a tracker score, not a safety finding for a terminal gate.
What the 12 October batch actually names
SOCRadar’s table is the fullest public inventory. Container terminals and port operators on the posting include Santos Brasil, Portonave and Superterminais in Brazil; Asyaport in Turkey; MGNP, BNCT and Pusan Newport Company in South Korea; TTI Algeciras in Spain; Eurogate Tanger in Morocco; NCT Kandla in India; Nam Dinh Vu Port in Vietnam; and NEOM Ports in Saudi Arabia. Port IT, EDI and terminal-system names include GNCNet / DGT Busan, GCS Kuwait, ILCS Pelindo, HPC Hamburg Port Consulting and T2S in Brazil. Shipping lines and operators include Ocean Network Express in Singapore, CULines, T.S. Lines, Polaris Shipping, Dong-A Tanker, Samjoo Maritime, Korea Ferry, Camellia Line, Tsuneishi / Kambara Kisen and Samudera. Agency, logistics, depot and survey names include Saehan Marine, EUSU Logistics, BKH ICD, April Asia, GlobalNet LCL, Yusen Logistics Hong Kong, Premier Alliance and BMT IQ. Adjacent names include ZPMC, Apical Group and Dongkuk Steel. South Korea accounts for 12 of the 38 entries. The Maritime Executive also flags ZPMC, the Chinese crane manufacturer, as in the blast radius.
Cydome’s 14 October warning, as carried by Digital Ship and World Ports, is a narrower operator note on the same leak-site event. It says 10 of the 37 organisations it counted, about 27 per cent, were shipping companies, most of them in Asia-Pacific, and names Ocean Network Express, CULines and Polaris Shipping among those reportedly affected. Hold the 38 and 37 counts as two reads of one batch, not as two incidents. Hold Cydome’s CyberLogitec line as an assessment. Cydome itself said the source and scope remain unconfirmed. SOCRadar did not present a verified CyberLogitec intrusion. Port News, on Thursday, repeated that CyberLogitec has documented technology links with several organisations in the cluster but that there is no verified evidence it was the source.
Why the data look like one shared system
The operational question is not whether 38 companies were each hacked in isolation. SOCRadar’s reviewed postings describe small, application-scoped archives: 23,507 EDI message files at Nam Dinh Vu Port; 2.4 GB and 108 files at ILCS Pelindo; 1.5 GB and 774 files at Pusan Newport Company, including container documentation, EDI shipping records, deployment material and terminal-system configuration; 660 MB at Eurogate Tanger; 90 MB at BMT IQ; 60 MB at EUSU Logistics. The same narrow categories recur across countries: EDI messages, manifests, gate and equipment-interchange records, terminal configuration, release documents and deployment material. SOCRadar did not find infostealer credential matches for many of the listed maritime domains, which undercuts n0n’s earlier documented entry path as the explanation for this batch. The pattern resembles earlier mass-exploitation extortion waves against widely deployed file-transfer products, without evidence that n0n is those campaigns. A shared source also widens the exposure beyond the named 38. Nam Dinh Vu Port’s own posting, as quoted by SOCRadar, said the archive would expose cargo flows, booking relationships and operational records of every carrier that called at the terminal.
The leak-site mechanics are part of the pressure. Reviewed maritime entries were posted already named, marked “NOT PAID, EXPOSED,” with a single countdown to 19 October, 13:27 UTC. That is a seven-day window, not the group’s earlier staggered one-to-three-day anonymised “PENDING EXPOSURE” rhythm. Settlement demands reviewed by SOCRadar range from 2.4 million to 14 million US dollars, payable in bitcoin to a unique address, with some pages requiring a 10 per cent payment before a private negotiation room opens. Demands do not scale with volume. EUSU Logistics faces the highest reviewed figure, 14 million dollars for a claimed 60 MB. ILCS Pelindo’s 2.4 GB carries a 2.4 million dollar demand. Eurogate Tanger is printed at 6 million. Those figures are the actor’s ask. They are not a confirmed loss and not a reason to treat payment as a control.
Operational implications
For a DPA, a liner operator, a terminal, or a ship manager whose agents exchange EDI with any of the named ports, Thursday’s useful fact is the clock and the shared-system hypothesis, not a confirmed outage at ONE, Busan or Santos. No listed organisation had publicly confirmed an incident as of SOCRadar’s writing, the Maritime Executive’s 14 October piece, or Port News on 15 October. Specificity in the file descriptions — bunker-cost calculations, demurrage and despatch, port disbursement accounts — cuts toward the claims being hard to invent at scale. Templated language and the group’s unconfirmed earlier high-profile claims cut the other way. The 19 October publication time is the test. Whether data appears, how much, and whether interchange headers match a named TOS, EDI hub or file-transfer product will show what n0n actually holds.
Cydome’s operator advice is the conservative line even if CyberLogitec is not the source: check supplier exposure, review vendor access, and assess credentials shared through support channels. SOCRadar’s list is more concrete: map port-community systems, EDI hubs, terminal-system vendors and file-transfer services; patch internet-facing EDI, file-transfer and TOS components; rotate SFTP, AS2, VAN and vendor-support accounts; search stealer logs for staff and vendor credentials; close exposed RDP; and draft customer and regulator language now, because a partner’s archive can publish a carrier’s bookings even when the carrier’s own network is clean. That last point is the one that reaches ships that were never on the leak site. A box moving through Kandla, Busan, Tanger Med, Santos or Hai Phong this month can sit in the claimed EDI pile without the owner ever having heard of n0n.
Do not recast the 12–14 October reporting as a confirmed CyberLogitec breach, as a confirmed incident at Ocean Network Express or any other named line, as a traditional ransomware encryptor already in production, as a rewrite of Singapore’s MPA port-cybersecurity bill, as a CIRCIA reporting file, or as a follow-on to the Vivit Africa LNG cargo-system suspicion. Do not treat the bitcoin demands as a control. The confirmed public facts are a 12 October leak-site batch of 38 maritime names, a 19 October 13:27 UTC countdown, SOCRadar’s shared-application read, Cydome’s unconfirmed CLT assessment, and no victim confirmation.
What Operators Should Note
- Log a leak-site clock, not a confirmed breach. n0n batch posted 12 October. Publication time on the reviewed maritime entries: 19 October, 13:27 UTC. SOCRadar 13 October inventory of 38 organisations in 18 countries. Cydome 14 October warning, as reprinted 14–15 October, counted 37 and named a possible CLT shared environment. No listed maritime organisation had publicly confirmed an incident. Keep the two counts as two reads of one event.
- Assume shared EDI and TOS data, not 38 separate network intrusions. Recurring categories: EDI messages, manifests, gate and equipment-interchange records, terminal configuration, release documents, deployment material. Reviewed volumes run from 60 MB to 2.4 GB. Nam Dinh Vu Port is described as 23,507 EDI files exchanged with multiple lines. A carrier that never sat on the leak site can still be in those headers. Map which port-community, TOS, EDI and file-transfer products carry your bookings, then ask those vendors whether they are investigating.
- Hold CyberLogitec as an unconfirmed assessment. Cydome pointed to a possible compromise of a shared environment associated with CLT because of documented ties to named organisations. Source and scope remain unconfirmed. Port News on Thursday repeated that there is no verified evidence CyberLogitec was the source. Do not brief owners that CLT has been breached. Do brief them to review vendor access and support-channel credentials anyway.
- Rotate integration credentials before 19 October if you have not already. SFTP, AS2, VAN and vendor-support accounts used for EDI and terminal systems, starting with shared or long-lived ones. Patch internet-facing file-transfer and TOS components. Enforce MFA on VPN. Remove exposed RDP. Search stealer logs for staff and vendor credentials. Those steps do not depend on a victim confirmation.
- Do not treat the ransom table as a control. Reviewed asks: 2.4 million to 14 million US dollars in bitcoin. EUSU Logistics 14 million for a claimed 60 MB. ILCS Pelindo 2.4 million for 2.4 GB. Eurogate Tanger 6 million, with a 10 per cent entry fee printed for a negotiation room. Payment is not a restoration guarantee, not a legal clearance, and not an SMS option. Prepare customer and regulator language for counterparty exposure instead.
- Keep this file off the Hormuz and onboard-OT sheets. This is shore-side commercial and terminal data, not a projectile warning and not a cargo-control malfunction on a named hull. It is also not Singapore Bill 24/2026 and not the CIRCIA/OIRA reporting fight. Watch whether data lands on 19 October, whether interchange headers name a product, and whether ONE, a Busan terminal, CyberLogitec or another listed party confirms. Until then the working instruction is vendor review, not a casualty circular.
Regulas Shipping will keep lining n0n’s 19 October leak clock against SOCRadar’s shared-application read and Cydome’s unconfirmed CLT assessment so operators can treat the 38-name batch as a vendor and EDI exposure, not as a confirmed breach at any named line or terminal.
