38 maritime firms face $14m ransom deadline
A cyber extortion group has set an October 19 deadline for 38 shipping and port firms to pay ransoms of up to $14.
A cyber extortion group has given 38 shipping lines, port operators, and logistics firms until 13:27:10 UTC on October 19 to pay ransoms of up to $14 million or risk having stolen data published on the dark web.
The targeted firms include 12 port and container terminal operators, such as Santos Brasil, Portonave, and Eurogate Tanger, alongside 10 shipping lines, including Ocean Network Express (ONE) and TS Lines. Despite the scale of the threat, none of the affected companies have publicly confirmed that their systems were compromised or that n0n possesses the data it claims to hold.
How the extortion operation works: maritime cyber extortion
n0n operates as a data-theft extortion group, distinct from conventional ransomware gangs that encrypt victims’ systems. Instead, the group steals sensitive data and threatens to release it unless ransoms are paid. According to cybersecurity firm SOCRadar, the ransom demands reviewed range from $2.4 million to $14 million, with payments required in Bitcoin. The group’s dark web leak site further complicates negotiations by requiring victims to pay a fee, such as 10% of a $6 million demand, to access a private negotiation room.
The data n0n claims to have stolen varies by victim but includes EDI archives, container manifests, vessel schedules, gate movement records, commercial documents, internal system configurations, employee accounts, and financial records. However, SOCRadar emphasised that the authenticity, completeness, and recency of these datasets remain unverified. The firm suggested that the relatively small, application-specific datasets claimed for several victims could indicate a shared vulnerability or a common software provider, though this remains speculative.
Maritime cybersecurity company Cydome has pointed to a possible link to software provided by CyberLogitec, a South Korean firm specialising in terminal operating systems and maritime logistics platforms. CyberLogitec’s solutions are widely used across global ports, including those targeted in this attack, such as Pusan Newport Company and TTI Algeciras. The company has not issued a public statement regarding the alleged breach, leaving the extent of any compromise unclear.
Port operators and shipping lines increasingly depend on electronic data interchange (EDI) systems to manage cargo movements, vessel schedules, and customs documentation.
The global impact on maritime supply chains
However, the reach extends far beyond the region, with victims spanning Europe, the Americas, and the Middle East. The inclusion of terminal operators such as Eurogate Tanger in Spain and Santos Brasil in Brazil underscores the global nature of the threat.
While the immediate financial impact of the ransom demands is significant, the potential leakage of sensitive operational data, such as vessel schedules and container manifests, could have far-reaching consequences for global trade.
For the targeted companies, the immediate priority is assessing the validity of n0n’s claims. Many may be conducting internal investigations to determine whether their systems were breached and, if so, the extent of the data accessed. The lack of public confirmation from victims suggests that some may be negotiating privately with the extortionists or weighing the risks of disclosure against the potential reputational damage. In such cases, firms often engage cybersecurity firms to conduct forensic analyses and, if necessary, contain the breach.
What this means for the maritime industry and its stakeholders is a heightened risk of operational disruption. Ports and shipping lines rely on precise scheduling and coordination to ensure the smooth flow of goods. The exposure of vessel schedules or container manifests could enable criminals to track high-value cargo, increasing the risk of theft or piracy. Similarly, the leakage of commercial documents or financial records could provide competitors with insights into pricing strategies, contractual terms, or supplier relationships, undermining market competitiveness.
As the October 19 deadline approaches, the maritime industry is bracing for potential fallout. If n0n follows through on its threat to publish the data, the consequences could extend beyond financial losses to include regulatory scrutiny and legal action. Companies found to have failed in their duty to protect sensitive data may face fines under regulations such as the EU’s General Data Protection Regulation (GDPR) or sector-specific guidelines issued by bodies like the IMO.
For stakeholders, including shippers, freight forwarders, and customs authorities, the incident serves as a reminder of the importance of due diligence. Firms may need to review their contracts with logistics providers to ensure robust cybersecurity clauses are in place, including requirements for breach notifications and indemnification in the event of a cyber incident. Additionally, companies should consider diversifying their supply chains to reduce reliance on single providers, thereby mitigating the impact of potential disruptions.
Cybersecurity firms such as SOCRadar and Cydome are likely to play a critical role in the coming days. These companies offer threat intelligence services that can help organisations assess their exposure to the n0n group and other cyber threats. They also provide incident response support, including forensic analysis, data recovery, and negotiation with extortionists. For firms without in-house cybersecurity teams, engaging such services may be the most effective way to respond to the threat.
The n0n attack also raises broader questions about the resilience of global supply chains in the face of cyber threats. As digitalisation accelerates, the maritime sector must invest in cybersecurity measures that go beyond compliance to address emerging risks. This includes regular vulnerability assessments, employee training on cyber hygiene, and the adoption of advanced threat detection technologies. Collaboration between industry stakeholders, governments, and cybersecurity experts will be essential to developing a coordinated response to such threats.
n0n first emerged in September and previously targeted 21 organisations across 17 countries, including investment firms, telecommunications companies, and retailers. The group’s shift towards maritime targets in October suggests a deliberate strategy to exploit vulnerabilities in a sector critical to global commerce. With the deadline fast approaching, the maritime industry is watching closely to see whether any of the targeted firms will break their silence or if the extortion attempt will unravel under scrutiny.
“The claims by n0n should be treated as unverified until independent confirmation is provided. The lack of public statements from the targeted companies leaves many questions unanswered.”
SOCRadar·Cybersecurity firm
For those seeking further information, industry bodies such as the International Association of Ports and Harbors (IAPH) and the Baltic and Baltic and International Maritime Council (BIMCO) (BIMCO) provide resources on cybersecurity best practices. Additionally, cybersecurity firms like SOCRadar and Cydome offer updates on emerging threats through their websites and threat intelligence platforms. As the situation develops, stakeholders are advised to monitor official communications from the targeted companies and relevant authorities for updates.
Sign up free to ask CAMAL AI for a summary, the key points or anything else about this story.
Related stories
CAMAL AI
Financial Ports Newsletter
The maritime economy, every morning
Ports, shipping and freight markets in one short email. Free.
