Global Data Breach: Major Ransom Demands Made as Maritime Entities Face Shrouded Adversary

Palaemon Intelligence Team

Oct 15

4 min read

Maritime companies and related infrastructure should be advised, the data-extortion group n0n appears to have targeted up to 38 separate entities in a major data ransom event.

Glowing warning screen over a laptop reads SYSTEM HACKED, with a hand reaching toward the display in a dark, tense scene. — The ***n0n*** group appears to have infiltrated 38 individual entities in the maritime space, holding all for ransom in the millions (Credit: Maintenanceandcure.com)

Starting in September of this year, the data-extortion group which has gone by the name of n0n has been a scourge to a multitude of business sectors including investment firms, telecommunications, retail, education, and pharmaceuticals.

The group, which some cybersecurity firms believe to be headquartered in Russia, had targeted up to 17 countries within the aforementioned sectors but had never reached the maritime space. That has now changed.

Shifting Targets: Maritime Space Breached

On October 12th, the group released a statement on the Dark Web claiming to have breached the security and collected data from 38 separate entities within the maritime space.

Not only was this a major shift in their target sectors, but also a significant escalation in the number of targets within one breach. The targets spanned across 18 countries, but it appears at this moment in time that South Korea was the worst affected, with 12 named entities based there.

While the full list of named entities released by the n0n group is still being discovered, the names of some companies are known. Those named so far are:

Ocean Network Express (Japanese and Singaporean)
CULines (Chinese)
T.S. Lines (Taiwanese)
Samudera (Indonesian)
ZPMC (Chinese)
Santos Brasil (Brazilian)
Portonave (Brazilian)
BNCT (Busan Port, South Korea)
Pusan Newport Company (Busan Port, South Korea)
TTI Algeciras (Algeciras Port, Spain)
Eurogate Tanger (Tanger Port, Morocco)
Nam Dinh Vu Port (Hai Phong City Port, Vietnam)
NEOM Ports (NEOM Port, Saudi Arabia)

While the list above is not all encompassing, the group has claimed to have also infiltrated port authorities in India as well as others not yet named.

Aerial view of a busy container port at sunset beside desert mountains, with ships, warehouses, roads, and calm water. — NEOM Ports, one of those affected by the data breach (Credit: NEOM)

Unconfirmed Yet Taken Seriously

Importantly, while the group has claimed to have collected the data from each of the named entities, no company spokesperson nor port authority has released a statement confirming the breaches.

However, the security research firm SOCRadar has traced the breaches and the information provided appears to be accurate. Further, the Israeli-based maritime cybersecurity firm Cydome has also investigated and appears to confirm aspects of the breach.

Cydome released a statement saying, “Our assessment points to a possible compromise of a shared environment associated with CLT, a maritime software provider with documented ties to many of the named organizations. The source and scope remain unconfirmed”.

From the available information currently, the n0n group appears to rely on ‘low-tech’, easily accessible tools to complete their attacks. Instead of using highly sophisticated, dedicated ransomware technology, the group appears to have relied on using victim identification information through administrator tools in order to break into various entities.

Calendar page with red October header and large black 19 on a white background — Those affected have until October 19th 2026 to pay the ransom, or risk their data being released publicly (Credit: InchCalender)

Ransom in the Millions: Time Ticking Down Quickly

At the moment, no named entity has released a statement, confirming nor denying the breaches have occurred however, that has not stopped the n0n group from releasing their demands.

As of October 15th, the group appears to have released their ransom demands which amount to the sum of between $2.4million - $14million US Dollars, payable in Bitcoin.

Interestingly but not unsurprisingly, the group has placed a deadline on the ransom payments: October 19th at 13:27 UTC.

While it is not yet known as to why this exact time was chosen by the group, the group has vowed to publish all their information publicly if their demands are not met by then.

According to the group, the data they have collected allegedly includes EDI messages, container manifests, vessel schedules, gate movement records, equipment interchange records and terminal configuration details.

While this information is not itself highly damaging, the consequences of releasing any data to the public could disrupt port, terminal, and company activities during an already incredibly turbulent moment in the maritime space.

Geopolitical Turmoil Raising Suspicion

Although it is not known whether the ransom group are connected in any way to the Russian government or are working independently, the timing of the attack in regard to the geopolitical situation both in the Black Sea as well as the Strait of Hormuz does raise some questions.

It is currently unknown exactly how the group broke into each maritime entity however multiple security firms believe it to have been through a single, shared, third-party site which may have been accessed with employee credentials.

Therefore, in the interest of security, it is recommended to all maritime companies alongside port and terminal authorities to ensure their employees take proper care in securing their access. If any employee or company credentials have been recently exposed, it is recommended to reset these as well as encourage all active employees to use two-factor authentication when possible.

Dark webpage for Pusan Newport Company shows a ransom note and settlement amount of 12,000,000 USD (approx. 114 BTC). — One of the posts made by ***n0n*** regarding Pusan Newport Company, demanding $12 million USD (Credit: SOCRadar)

Security Recommendations and Further Developments

Further, multiple cybersecurity firms have advised maritime operators to assess supplier-side risks, review their vendor cyber permissions, and examine any and all credentials shared through support channels.

While these actions may not dissuade serious data-extortion groups or ransomware entities, they provide a good layer of protection to ensure proper security.

As of now, the ransom demands have not been met, and the listed entities have not paid out millions of US dollars to the n0n group, thus it will be interesting what happens when 13:27 UTC hits on October the 19th. Only the n0n group knows what will happen and it is in every maritime operator's best interest to follow the story as it develops.