THE SOCRadar cyber threat tracker reports that the n0n extortion group expanded its activity on 12 October 2026 by adding 38 global ports, shipping lines, port IT providers and related operators to its Dark Web leak site. The batch spans Brazil, Spain, Morocco, India, Vietnam, Singapore, China, Taiwan, Kuwait, Indonesia, Germany and a cluster of South Korean entities, signalling a shift from opportunistic cross‑sector theft to a maritime‑sector focus.
The posts suggest these may be 38 entries arising from a shared data source rather than 38 separate intrusions, with the data types described covering EDI messages, vessel schedules, port and terminal system records, and deployment materials.
Evidence cited by SOCRadar points to a shared access point or vulnerability rather than credentials stolen from each victim individually. Individual postings display narrowly scoped data sets, with volumes from tens of megabytes to a few gigabytes and file counts in the dozens to hundreds, characterised by repeated data types such as EDI documents, manifests and terminal system configurations.
The group assigns fixed USD settlement amounts for each victim, with an option to pay 10% to enter a private negotiation room in some cases, and a single publication deadline for the maritime batch: 19 October 2026 at 13:27 UTC. At the time of reporting, no maritime victim had publicly confirmed a breach. Organisations should prepare for potential disclosure by reviewing shared platforms, updating interfaces, rotating credentials and monitoring for related exfiltration activity.