An Extortion Group Says It Has Data From 38 Maritime Organisations: What Is Known, and What Crews Should Do

What Has Been Reported

Cybersecurity firms warned in mid-October that an extortion group calling itself n0n had added 38 maritime organisations to its dark web leak site in one batch. The listings are mostly container terminals and shipping lines, with some port IT providers, and include a cluster of South Korean operators. The group reportedly gave the targets a week, until 19 October, to pay in Bitcoin or have data published. Demands were reported at between USD 2.4 million and 14 million, with the group signalling willingness to negotiate.

It is described as a financially motivated data-theft group that first appeared in September 2026 and had listed 21 other organisations in 17 countries across other sectors.

What Is Not Known

• None of the 38 has confirmed a breach, and we are not naming any of them. A listing on a leak site is a claim, not evidence.
• One analysis suggests the data may not come from 38 separate intrusions. The datasets are small and the document types repeat, which could point to a single application or integration platform used by several organisations. That is a hypothesis, not a finding.
• What data was taken, and whether it includes crew or personal data, has not been reported.

We will not guess at causes. As with any developing incident, we will update only from confirmed sources.

What It Means For Seafarers

Whatever the truth of this claim, data stolen from shipping and port companies is used for the next attack. Crew lists, contact details, schedules and cargo documents all make phishing more convincing. The basics that matter on board and ashore:

1. Treat unexpected messages about cargo, port calls, crew changes and payments as suspect, even when they use correct names and details. Confirm by a known phone number.
2. Do not click links or open attachments from unfamiliar senders, and report them to the CSO or IT contact, even if you already clicked.
3. Use different passwords and multi-factor authentication for company and personal accounts.
4. Keep removable media off the ship’s networks unless it has been scanned.
5. Know how to report. Cyber risk is part of the Safety Management System under the ISM Code, since IMO Resolution MSC.428(98), and you should know your company’s reporting route before you need it.

Class and P&I organisations also published cyber guidance this week, including an Indian Register notice on the IMO guidelines on maritime cyber risk management and a Japan P&I Club document on cyber security measures aboard ships. We have only seen the titles, so we point you to them rather than summarise them.

Test Your Knowledge

Think you've got this covered? Put it to the test in Crew Connect's free Knowledge Checker — try a quick security round and see how you score.

Related Reading

• Tanker cyberattack pattern, 2026
• Week 42 2026 regulatory roundup