A shadowy cybercrime outfit known as “n0n Group” has issued an ultimatum. They claim to have breached 38 maritime, port, and logistics organizations. The group is demanding millions in ransom. They threaten to release stolen data by October 19, 2026. This threat has sent shockwaves through the global shipping industry. The deadline is fast approaching.
The n0n Group posted a list of the 38 companies on October 12, 2026. The group claims these organizations have been compromised. They are demanding payment to prevent the release of sensitive information. The ransom demands range from $2.4 million to $14 million per organization. Payment is expected in Bitcoin. This development highlights a growing trend in cyber warfare. It targets critical infrastructure sectors like maritime logistics. The industry is still reeling from previous cyber incidents.
Cyber Extortion Operation Details
The n0n Group is a relatively new player. Cybersecurity firms observed its emergence in September 2026. Its primary tactic appears to be data theft and extortion. Unlike traditional ransomware, it doesn’t necessarily encrypt systems. Instead, it steals data and threatens public disclosure. This method puts pressure on companies to pay to protect their reputations and operational data. The group’s methods reportedly involve using harvested credentials. They may also use legitimate remote administration tools.
The list of threatened companies is extensive. It includes major shipping lines like Ocean Network Express (ONE). It also names CULines, T.S. Lines, and others across Asia. Ports and terminal operators are also targeted. These include Santos Brasil, Portonave, and Eurogate Tanger. The Chinese crane manufacturer ZPMC is also on the list. These companies operate in 18 countries worldwide. The concentration of South Korean organizations is notable.
Maritime Industry’s Vulnerability
The maritime sector is increasingly reliant on digital systems. This digitization improves efficiency but also creates vulnerabilities. The 2017 NotPetya attack on Maersk serves as a stark reminder. That attack crippled global IT systems for days. It forced Maersk to rebuild much of its network. This event prompted a re-evaluation of cybersecurity practices across the industry. Many companies adopted segmented networks and improved incident response plans. However, the current threat from n0n Group shows these measures are still insufficient.
Recent reports indicate a surge in cyber incidents within the maritime industry. In 2025, cyber incidents jumped by 103%. DDoS attacks, ransomware, and malware are common threats. The growth rate of these attacks has more than doubled. This trend underscores the critical need for robust cybersecurity. It’s especially important for interconnected port and shipping systems.
Official Statements and Unverified Claims
As of October 15, 2026, none of the 38 named organizations have publicly confirmed a breach. This lack of confirmation is typical for data-theft extortion operations. Companies may choose to investigate privately. They might pay to avoid public exposure. The claims made by n0n Group remain unverified. However, the threat itself is significant. It highlights potential vulnerabilities in third-party providers and terminal systems.
The Port of Rotterdam is also facing increased cybersecurity scrutiny. Starting August 15, 2026, new Dutch cybersecurity obligations took effect. Hundreds of companies in the port are now subject to registration and incident reporting. This includes a duty of care. These measures stem from the EU’s NIS2 Directive. The goal is to enhance the resilience of critical infrastructure. This includes port operations, vessel coordination, and cargo handling systems.
Context of Recent Attacks
The maritime sector has seen several cyber incidents in 2026. In June 2026, a ransomware attack on the Adriatic Port Authority froze terminal operating systems. This halted vessel unloading. It was attributed to the Anubis cybercriminal group. In the United States, a coordinated attack in mid-June affected over 200 logistics and transport entities. This breach compromised cargo tracking and terminal scheduling systems. It led to an estimated $380 million in delays and backlogs.
Earlier in 2026, the Port of Rotterdam itself was targeted. A DDoS attack, attributed to the pro-Russian group NoName057(16), disrupted online operations. This was reportedly in retaliation for Dutch plans to supply tanks to Ukraine. Such geopolitical motivations are increasingly tied to cyber warfare. The Dutch National Cyber Security Center identified the perpetrators. This incident followed similar attacks on other Dutch ports like Amsterdam and Groningen.
What Happens Next?
The deadline for the n0n Group’s ultimatum is October 19, 2026. Companies on the list face a critical decision. They must assess the credibility of the threat. They also need to evaluate their own security posture. Many organizations are likely engaging cybersecurity experts. They are working to determine if a breach has occurred. They are also exploring options to mitigate potential data release.
Investigations into how n0n Group gained access are ongoing. The group’s emergence in September 2026 suggests a rapid escalation. The global maritime industry must remain vigilant. It needs to strengthen its defenses against evolving cyber threats. This includes addressing third-party risks and ensuring robust incident response plans. The outcome of this threat could have far-reaching implications for global trade and security. More information will be available as the deadline approaches.
