The financially motivated extortion group n0n published a first batch of downloadable archives on its dark-web leak site after the 19 October, 13:27 UTC countdown passed, according to Boannews on Tuesday, 20 October, timestamped 16:24 Korea Standard Time, about 07:24 UTC. The Korean cybersecurity daily said the group uploaded zip files against all 12 Korean port, shipping, logistics and steel names that had sat on the 12 October maritime batch. The actor’s own notice, as quoted by Boannews, called the upload the first public slice of material it said had been taken from company systems and stored off-site, and said further publication would continue until an agreement was reached. This is a leak-site publication file. It is not a confirmed CyberLogitec incident, not a confirmed breach of any named line’s own network, and not a rewrite of Thursday’s dedicated 38-name countdown piece.
Thursday’s dedicated file, posted on this desk on 15 October, recorded the 12 October leak-site batch of 38 organisations, the common 19 October 13:27 UTC clock, SOCRadar’s shared-application read, and Cydome’s unconfirmed assessment of a support archive associated with the Seoul maritime-software house CyberLogitec, also printed as CLT. That piece closed on the test: whether data would appear after the clock, how much, and whether interchange headers would name a product. Tuesday’s Korean report answers the first of those questions for the Korean slice only. It does not convert the remaining 26 names into a confirmed publication, and it does not convert Cydome’s vendor line into a confirmed intrusion.
What Tuesday’s Korean report actually printed
The twelve names Boannews listed on Tuesday are the same Korean cluster already on Thursday’s inventory: Pusan Newport, Dongkuk Steel, Samjoo Maritime, EUSU Logistics, BKH ICD, Korea Ferry, Saehan Marine, Dongwon Global Terminal Busan, Masan I-Port, BNCT, Polaris Shipping and Dong-A Tanker. Hold BKH ICD, the spelling on Thursday’s SOCRadar-based inventory, beside BKH IDC, the spelling in the Korean daily. That is one listing, not two firms. The daily said the earlier leak-site pages had shown file names only. After the countdown, it said, the group placed compressed archives on the leak site in a form that could be downloaded. The actor’s accompanying text, as carried by the daily, described inter-company correspondence and operating documents and labelled the upload a first public tranche.
The daily described the categories it said were visible on one steel-company listing and one shipping-company listing: invoice item-code work, internal software-component files and contract-type material on the steel side; business-plan, performance, export and vessel-schedule files on the shipping side. Those are category labels from a news report. They are not a verified inventory, not a reproduction of the archives, and not a reason to treat every named Korean company as having lost a current production database. Cydome’s 15 October analysis, written before the clock, had already warned that some sample dates ran from 2009 to August 2026 and that older material is not necessarily current. Hold that caution on Tuesday’s publication the same way it sat on Thursday’s samples.
Cydome’s 15 October note, as restated by Smart Maritime Network on 20 October, remains the working vendor read, not a confirmation. Cydome counted at least 21 of the 38 organisations as publicly documented CyberLogitec customers and said seven sample file names included the vendor’s name or a product name, among them OPUS Terminal and ALLEGRO. Its interim assessment was a single support-and-project archive split into per-customer listings, not 38 separate network intrusions. Cydome itself said the source, the system accessed, the method and the volume per customer remain unconfirmed, and that being named on the leak site does not mean an organisation’s own network was breached. Korean trade press, as cited by Cydome, had already reported that CyberLogitec notified named customers as a precaution and that their systems were operating normally. CyberLogitec has not publicly confirmed an incident. Do not brief owners that it has.
What the 38-name batch still is, and is not
The 12 October batch remains one event. SOCRadar’s table is still the fullest public inventory: terminals and port operators including Santos Brasil, Portonave, Superterminais, Asyaport, MGNP, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, NCT Kandla, Nam Dinh Vu Port and NEOM Ports; port-IT and EDI names including GNCNet / DGT Busan, GCS Kuwait, ILCS Pelindo, HPC Hamburg Port Consulting and T2S; lines and operators including Ocean Network Express, CULines, T.S. Lines, Polaris Shipping, Dong-A Tanker, Samjoo Maritime, Korea Ferry, Camellia Line, Tsuneishi / Kambara Kisen and Samudera; agency, logistics and survey names including Saehan Marine, EUSU Logistics, BKH ICD, April Asia, GlobalNet LCL, Yusen Logistics Hong Kong, Premier Alliance and BMT IQ; adjacent names including ZPMC, Apical Group and Dongkuk Steel. South Korea accounts for 12 of the 38. Tuesday’s publication, as reported, covers that Korean twelve. It does not, on the Korean daily’s face, print a matching zip drop against ONE, Santos Brasil, Eurogate Tanger, NEOM Ports or ZPMC.
The demand table is unchanged as an actor ask. Cydome added the 38 listings to about 1.22 billion US dollars, with individual figures from 400,000 to 400 million. Four listings sat at 100 million or more: Ocean Network Express at 400 million, Apical Group at 320 million, ZPMC at 160 million and Dongkuk Steel at 100 million. Cydome noted that some Korean-press figures, including 10 million dollars against Dongkuk Steel, match the 10 per cent negotiation-room option rather than the full printed demand. Thursday’s SOCRadar range of 2.4 million to 14 million dollars remains a reviewed-ask band on a different read of the same pages. None of those numbers is a confirmed loss, a legal clearance or a restoration guarantee. Payment is still not a control.
KISA, the Korea Internet & Security Agency, had already notified listed Korean companies after the 12 October posting, according to the 13 October Boannews report that first named the Korean twelve. Dongkuk Steel told Korean reporters then that it could not confirm actual penetration and that it was checking. That earlier non-confirmation is still in force as a company line. A KISA notice is a national-agency alert. It is not, by itself, a finding that each of the twelve suffered a separate network intrusion, and it is not a CyberLogitec confirmation.
Operational implications
For a DPA, a liner operator, a terminal or a ship manager whose agents exchange EDI with Busan, Tanger Med, Santos, Kandla, Hai Phong or any other named port, Tuesday’s useful fact is that n0n followed through on the Korean slice of the clock. The shared-system hypothesis is now harder to treat as a bluff, because a newsroom has reported downloadable archives rather than file names alone. It is still not a confirmed outage at Ocean Network Express, Pusan Newport or CyberLogitec. Specificity in the reported categories — vessel schedules, export files, invoice-code work — cuts toward the actor holding something that looks like commercial archives. The remaining 26 listings, the absence of a named-organisation confirmation, and Cydome’s own unconfirmed vendor line cut the other way. Brief the publication. Do not brief a completed 38-name dump or a completed CLT finding.
The blast radius is still wider than the twelve Korean names. Thursday’s file already recorded Nam Dinh Vu Port as 23,507 EDI message files exchanged with multiple lines, and Cydome recorded stowage, booking, gate-move and loading-list samples that can carry another carrier’s headers. A box that moved through a listed terminal this year can sit in an archive without the owner ever having been printed on the leak site. That is the instruction that reaches ships that were never on the 38-name list. Map which port-community, TOS, EDI and file-transfer products carry your bookings. Ask those vendors, including CyberLogitec if you use OPUS Terminal, ALLEGRO, OPUS Bulk, CARA or OPUS D&D, whether they are investigating. Rotate SFTP, AS2, VAN and vendor-support accounts. Treat real ticket numbers, engineer names and invoice templates as phishing bait even if your company is not among the twelve.
Do not recast Tuesday as a confirmed CyberLogitec breach, as a confirmed incident at Ocean Network Express or any other named line, as a traditional ransomware encryptor already in production, as a completed publication of all 38 listings, as a rewrite of Thursday’s dedicated countdown piece, as a rewrite of Singapore’s MPA cybersecurity bill, or as a CIRCIA reporting file. The confirmed public facts are a 12 October leak-site batch of 38 maritime names, a 19 October 13:27 UTC countdown that has now passed, a 20 October Korean news report that n0n placed downloadable archives against the 12 Korean names, SOCRadar’s shared-application read, Cydome’s unconfirmed CLT assessment, and still no public confirmation by CyberLogitec or by a named organisation that its own network was the source.
What Operators Should Note
- Log a Korean publication, not a completed 38-name dump. n0n batch posted 12 October. Clock: 19 October, 13:27 UTC. Boannews 20 October, 16:24 KST / 07:24 UTC, reported downloadable zip archives against the 12 Korean names. Thursday’s dedicated piece remains the countdown file. This piece is the first reported follow-through. The other 26 listings are not, on that report, a matching zip drop.
- Hold the twelve names as one Korean cluster, not twelve proven network intrusions. Pusan Newport, Dongkuk Steel, Samjoo Maritime, EUSU Logistics, BKH ICD, Korea Ferry, Saehan Marine, Dongwon Global Terminal Busan, Masan I-Port, BNCT, Polaris Shipping, Dong-A Tanker. BKH ICD and BKH IDC are one listing. KISA notified Korean companies after 12 October. Dongkuk Steel’s mid-month line was that it could not confirm penetration. A leak-site zip is not, by itself, a finding that each firm’s own network was the source.
- Keep CyberLogitec as an unconfirmed assessment. Cydome 15 October: at least 21 of 38 documented CLT customers; seven sample names pointing at OPUS Terminal or ALLEGRO; single support-archive hypothesis; source and scope unconfirmed. Smart Maritime Network restated that read on 20 October. Korean trade press said CLT sent a precautionary customer notice and that systems were operating normally. CyberLogitec has not publicly confirmed an incident. Review vendor access anyway if you use those products.
- Assume shared EDI and TOS data can name a carrier that never sat on the leak site. Recurring categories from the 12–15 October reads: EDI messages, manifests, gate and equipment-interchange records, terminal configuration, release documents, deployment material. Cydome flagged BAPLIE, COPARN, CODECO and COPRAR samples. Map port-community, TOS, EDI and file-transfer products that carry your bookings, then ask those vendors whether they are investigating.
- Rotate integration credentials and treat ticket detail as phishing bait. SFTP, AS2, VAN and vendor-support accounts, starting with shared or long-lived ones. Patch internet-facing file-transfer and TOS components. Enforce MFA on VPN and vendor portals. Remove exposed RDP. Warn operations, IT and finance that real ticket numbers, engineer names and invoice templates make convincing lures even for companies that were never listed.
- Do not treat the ransom table as a control. Cydome total about 1.22 billion US dollars across 38 listings, 400,000 to 400 million each. ONE 400 million, Apical 320 million, ZPMC 160 million, Dongkuk Steel 100 million. Some Korean-press figures match the 10 per cent negotiation option. Payment is not a restoration guarantee, not a legal clearance, and not an SMS option. Prepare customer and regulator language for counterparty exposure instead.
Regulas Shipping will keep lining n0n’s first reported Korean publication against Thursday’s 38-name countdown, SOCRadar’s shared-application read and Cydome’s unconfirmed CLT assessment so operators can treat Tuesday’s zip drop as a vendor and EDI exposure that has now moved from clock to publication, not as a confirmed breach at any named line or terminal.
