What data was allegedly stolen in the n0n attack?

According to SOCRadar's analysis, the cyber group claimed to have obtained electronic data interchange (EDI) messages, container manifests, vessel schedules, gate movements, and terminal system configuration records. The claimed data volumes ranged from 60 megabytes to 2.4 gigabytes per organization. This type of operational data can reveal cargo movements, bookings, and commercial relationships across the supply chain.

How many organizations are affected, and where are they located?

The n0n group named 38 organizations across 18 countries on October 12, 2024. South Korea accounted for 12 listings, with additional victims in Brazil, Singapore, China, Taiwan, Spain, Morocco, Indonesia, Malaysia, and Japan. The victims include container terminals, shipping lines, port IT providers, and logistics businesses.

Why do researchers believe this was a single coordinated attack rather than separate breaches?

SOCRadar identified a pattern suggesting a possible common point of entry. The evidence includes relatively small, narrowly focused datasets with recurring document types (EDI messages, manifests, schedules), and the absence of matching credential theft records for most victims. This pattern is reminiscent of mass-exploitation campaigns targeting shared file-transfer platforms, such as the MOVEit Transfer and Cleo incidents.

What should maritime businesses do to protect themselves?

SOCRadar recommended that affected organizations and their supply chain partners: identify port community systems, EDI hubs, and file-transfer services handling their data; check with providers for breaches and patch exposed systems; investigate unusual access or bulk downloads; rotate integration credentials; enforce multi-factor authentication on remote access; remove internet-exposed RDP services; and prepare communications for customers and regulators. Organizations should also monitor n0n's leak site for further postings.

What is the financial impact of n0n's demands?

Settlement demands have ranged from $2.4 million to $14 million, payable in bitcoin. Notably, the amounts do not appear to correlate with data volume: EUSU Logistics faced a $14 million demand for only 60 megabytes, while ILCS Pelindo received a $2.4 million demand for 2.4 gigabytes. Some listings offered victims the option to open negotiations after paying 10% of the initial demand.

Risk & Disruption

High Impact

38 Shipping and Port Groups Hit by Data Extortion Threat

Oct 14, 2026

Get tomorrow's supply chain signal

Daily supply-chain brief. Free, unsubscribe anytime.

The signal

A newly active cyber extortion group called n0n has publicly named 38 shipping, port, and logistics organizations across 18 countries as victims of a coordinated data theft campaign, raising alarm about potential exposure of operational data including container manifests, vessel schedules, and terminal configurations. The scale of the attack more than doubled the group's previous victim count, and cybersecurity researchers suggest the organizations may share a common point of compromise, such as a shared EDI platform or file-transfer service, rather than suffering 38 separate breaches.

The group has set a publication deadline of October 19, 2024, and is demanding settlements ranging from $2.4 million to $14 million in bitcoin, creating urgent pressure on affected organizations to respond. This incident reflects a troubling shift in maritime cyber threats: rather than deploying traditional ransomware, n0n focuses on data theft and extortion, which can still cause significant operational disruption while leaving businesses uncertain about the true scope of exposure.

The potential compromise of EDI records and manifests could expose confidential cargo movements, commercial relationships, and booking data involving multiple supply chain partners beyond the named victims.

#cybersecurity-threat

Frequently Asked Questions

What This Means for Your Supply Chain

Simulation Suggestion

immediate

What if EDI and manifest data from a shared platform becomes public on October 19?

If n0n releases the claimed data containing container manifests, vessel schedules, and EDI records from a shared port community system or integration platform on the October 19 deadline, supply chain visibility could be compromised across multiple organizations. Simulate the impact on routing decisions, cargo tracking accuracy, and competitive advantage if booking data and commercial relationships are exposed to competitors and market participants.

Run this scenario

Simulation Suggestion

this week

What if terminal operations are disrupted by system shutdowns or access restrictions?

Although n0n primarily uses extortion rather than ransomware, SOCRadar noted that the group's profile includes techniques associated with encryption and interference with recovery. If any affected terminal operators experience operational disruption due to system compromise or preemptive security lockdowns, simulate the impact on container throughput, vessel schedules, and regional port capacity across Southeast Asia, South Korea, and Brazil.

Run this scenario

Simulation Suggestion

this month

What if supply chain partners' confidential data is exposed, affecting contract negotiations and sourcing strategy?

If EDI records and commercial relationship data from affected organizations are published, downstream supply chain partners (shipping lines, shippers, consolidators) may face disclosure of proprietary booking rates, cargo volumes, and supplier relationships. Simulate the operational and financial impact if competitors gain visibility into contract terms, routing preferences, and volume commitments that were previously confidential.

Run this scenario

Go deeper:

Digital Twin in Supply Chain: What It Is and How to Choose Software

What a supply chain digital twin is, how to evaluate twin software, what it costs and how long it takes, and how it differs from network design tools.

Risk & DisruptionHigh Impact

38 Maritime Firms Hit by Cyber Extortion Group: Data Leak Threat

Oct 14, 2026

Risk & DisruptionHigh Impact

Direwolf Ransomware Targets Logistics and Port Infrastructure

Oct 14, 2026

Risk & DisruptionHigh Impact

Ceva Logistics Cyberattack Exposes Warehouse Data Across Europe

Aug 11, 2026

Get the daily supply chain briefing

Top stories, Pulse score, and disruption alerts. No spam. Unsubscribe anytime.