A data extortion group calling itself n0n listed 38 maritime organizations across 18 countries on its leak site on 12 October 2026, with a payment deadline of 19 October. According to maritime security firm Cydome, the advertised demands add up to about $1.22 billion, ranging from $400,000 to $400 million per listing. Risky Bulletin (23 October) calls it likely one of the largest cyberattacks on the maritime sector since NotPetya.
Much of this is still unconfirmed. Cydome's interim assessment is that the data may come from a single customer support and project archive at a shared maritime software provider, split into separate listings with a ransom demand for each customer. Cydome says at least 21 of the 38 listed organizations are publicly documented customers of that provider, that it cannot validate the authenticity of the data, and that it does not know which system was accessed or how. The provider has not publicly confirmed an incident, according to Cydome. Reports vary on the count: the leak-site batch lists 38 organizations, while Risky Bulletin reports 40+.
Who the actor is:
• Per Cydome, n0n first surfaced on 18 September 2026, and researchers who documented the group report that it gets in with credentials stolen by infostealer malware. Cydome does not attribute the group to any country.
• Risky Bulletin reports the group launched in mid-September and already lists more than 140 victims on its leak site, and that most of the maritime victims refused to pay and had data leaked.
What was listed:
• Container shipping lines, port terminal operators and port authorities, logistics companies, ship managers and port machinery developers.
• Based on sample file names, Cydome and Smart Maritime Network report the material may include user credentials, personal information, EDI messages such as stowage plans, bookings and gate moves, system documentation such as release notes, interface specifications and database scripts, and commercial records. Cydome says some listings also refer to server and network information. File dates run from 2009 to August 2026.
• Being named on the leak site does not necessarily mean a company's own network was compromised. Some of the material may have been held in a vendor's support environment.
What it means for port and terminal owners:
No source reports any impact on terminal operations or OT systems. The lesson is about what sits in vendor support archives. Over the years, operators send their software vendors credentials, network diagrams, configuration files, database exports and system documentation for terminal operating systems, gate and yard systems, and the interfaces into port OT. Old passwords get reused, and real ticket numbers, engineer names and EDI samples make very convincing phishing. Under the U.S. Coast Guard cyber rule for the Marine Transportation System (33 CFR Part 101, Subpart F), owners and operators are expected to account for supply chain and third-party risk in their Cybersecurity Assessment and Plan and to report reportable cyber incidents. On the vessel side, IACS UR E26 and E27 set cyber resilience requirements for ships and for the suppliers of onboard systems. This incident is a good test of whether your vendor risk program covers what your vendors hold about you.
What the Red Tiger team recommends:
1. Ask each of your maritime software vendors, in writing, whether your data, credentials or system documentation sit in their support, ticketing or project environments, and whether they have been affected.
2. Rotate any credential that has ever been shared with vendor support by email or ticket, including service, integration and admin accounts, and retire shared service-desk logins.
3. Review every vendor remote access path into terminal operating systems and port OT. Require MFA and session approval, log every session, and remove standing access you no longer need.
4. Add third-party data exposure to your incident response plan: who confirms where the data came from before anyone responds to a demand, who warns operations and finance about targeted phishing, and how you decide whether a report to the Coast Guard or the National Response Center is required.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: Cydome (15 Oct 2026): https://cydome.io/n0n-cyber-extortion-incident-involving-38-maritime-companies-likely-traces-back-to-a-single-vendor/
Smart Maritime Network (20 Oct 2026): https://smartmaritimenetwork.com/2026/10/20/cyber-group-lists-38-maritime-organisations-with-1-22bn-in-ransom-demands/
Risky Bulletin (23 Oct 2026): https://news.risky.biz/risky-bulletin-supply-chain-attack-lets-ransomware-group-inside-40-shipping-companies/
Check out our resources and book a follow-up call with our team.
