n0n Extortion Group Targets Global Shipping, Listing 38 Port and Maritime Firms on Its Leak Site

On 12 October 2026, the n0n extortion group added 38 organisations to its Dark Web leak site in a single batch. The list includes container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, port IT providers in Kuwait, Indonesia and Germany, and a dense cluster of South Korean operators. The batch more than doubles the group's public victim count and suggests a shift from opportunistic, cross-sector targeting to a clear sector focus.

The way the stolen data is described raises a bigger question for the maritime industry: are these 38 separate intrusions, or exposure flowing out of one shared system? n0n emerged in September 2026 and is financially motivated. According to SOCRadar's tracker profile, it gets in with credentials harvested by infostealer malware, steals material such as Active Directory mappings and legal documents, and then pressures victims with leak postings. It avoids traditional ransomware and instead manipulates victim data with administrative tools, though its ATT&CK mapping still includes encryption and recovery-inhibition techniques, so disruption cannot be ruled out.

Before this wave, the group's first 21 listings spanned investment firms, telecommunications, retail, education and pharmaceuticals across 17 countries. SOCRadar rates n0n near the top of its aggressiveness scale and near zero for lethality. Until an encryptor is publicly linked to the group, it is best treated as a data-theft extortion operation with the access to cause damage.