A new extortion crew, n0n, claims to have stolen data from 38 shipping, port and logistics organisations in 18 countries, and says it will publish on 19 October. One of them is the UK’s BMT IQ, and the evidence so far points at a shared maritime platform rather than dozens of separate intrusions.
What happened
On 12 October 2026 the n0n group posted 38 maritime and supply chain organisations to its leak site at once. Threat intelligence firm SOCRadar documented the postings in a report published on 13 October. Trade titles The Loadstar, Splash247 and TrasportoEuropa followed on 14 October.
Every name below comes from the criminals’ own listings. No listed organisation has yet acknowledged a compromise, so every claim below is unverified. According to the leak site, the batch includes:
- container terminal operators in Brazil, Spain, Morocco, India, Vietnam, Turkey and Saudi Arabia, among them Santos Brasil, TTI Algeciras and Eurogate Tanger
- a dense cluster of South Korean entries (12 in total), including BNCT and Pusan Newport Company in Busan
- carriers including Ocean Network Express, CULines and T.S. Lines
- port IT and consultancy providers such as HPC Hamburg Port Consulting and ILCS Pelindo
- one UK entry, BMT IQ, which SOCRadar groups with agencies, logistics, depots and surveying firms
For BMT IQ, n0n claims to hold about 90 MB across 18 files. The gang says these are e-invoices, inspection records and equipment interchange receipts. We have seen no statement from the company and cannot confirm the claim.
Demands seen by SOCRadar range between $2.4m and $14m in bitcoin. On some pages, a victim who wants to negotiate must first pay 10% of the demand to open a private negotiation room. The listings carry a “NOT PAID, EXPOSED” label and a countdown to 13:27 UTC on 19 October.
The technical picture
The most interesting part of this story is not the size of the list but what links the entries. SOCRadar sets out several reasons to doubt that n0n broke into 38 corporate networks one at a time.
First, the claimed data sets are small and narrow. They range from 60 MB attributed to South Korea’s EUSU Logistics to 2.4 GB attributed to Indonesia’s ILCS Pelindo, with most reviewed listings holding between 18 and 774 files. That looks like one application’s data store, not a plundered file server. Second, the same document types keep appearing across different countries and business types:
- EDI messages and container manifests
- vessel schedules and gate movement records
- equipment interchange receipts
- terminal system configuration and release documentation
Third, SOCRadar found no matching infostealer credentials for many of the listed maritime organisations. That matters because stolen staff logins are the group’s documented way in.
Taken together, this suggests a single platform shared by many of these firms, perhaps a terminal operating system, an EDI integration hub or a file transfer service. According to Splash247, maritime security firm Cydome has pointed to a possible connection with a CyberLogitec environment, while stressing that neither the source nor the scale of any breach is established.
The obvious comparison is with the 2023 MOVEit Transfer and 2024 Cleo campaigns, where one flaw in a popular transfer product produced a long tail of victims, though SOCRadar sees nothing tying n0n to either.
n0n appeared in September 2026 and had listed 21 victims across other sectors before this wave. Of those 21, SOCRadar says 19 remain at the “claimed” stage and only one has seen data leaked. n0n mostly steals and publishes rather than encrypting, but its ATT&CK profile includes encryption and recovery-inhibition techniques, so disruption cannot be ruled out.
Why it matters for UK organisations
Only one of the 38 names is British, but the exposure does not stop at the listed firms. Manifests, bookings and gate records describe the cargo, customers and trading partners of everyone whose freight moved through a terminal. UK importers, exporters, freight forwarders and hauliers exchange this kind of data with overseas terminals and carriers every day. Their commercial information could surface on 19 October even if their own networks are clean.
Several listings also mention employee accounts and financial records. If personal data about UK staff or customers turns up in a dump held by a third party, the UK GDPR breach assessment still falls to the controller. The 72-hour clock for notifying the ICO starts once you become aware, not once your supplier tells you. Ports and harbour authorities are also essential services under the NIS Regulations. The Cyber Security and Resilience Bill is set to put more weight on supply chain and managed service risk. A single compromised maritime platform feeding dozens of operators is exactly the kind of scenario that bill is meant to address.
Expert view
I would be cautious about the headline number: extortion crews pad their leak sites, and n0n’s record of confirmed leaks is thin. Still, specifics described, such as demurrage and despatch accounts, bunker cost calculations and port disbursement records, are not the sort of detail that is easy to invent at scale. The uniform deadline also fits data processed in one go.
When we test logistics and port-adjacent environments, the weak points are rarely the corporate laptops. They are the integration layer: SFTP accounts created years ago for a partner, AS2 endpoints exposed to the internet, vendor support logins shared between customers, and EDI hubs that nobody owns. These systems move other people’s data, often sit outside normal identity controls and are easily forgotten at patch time. If a shared platform is behind this, few of the named firms will have done anything unusual wrong. They will simply have trusted a supplier that held everyone’s data in one place.
What to do now
- Map your maritime data flows. List every port community system, terminal operator portal, EDI hub, VAN and file transfer service that carries your shipping data. If any named organisation is a counterparty, ask them directly whether they are investigating.
- Rotate integration credentials. Reset SFTP, AS2, VAN, API and vendor support accounts used for EDI, starting with shared or long-lived ones. This maps to Cyber Essentials user access control.
- Patch and reduce exposed interfaces. Bring internet-facing transfer and EDI components up to date and remove anything that need not be public, in line with the Cyber Essentials firewall and security update controls.
- Hunt for bulk downloads. Review recent transfer and application logs for unusual volumes or unfamiliar sources.
- Tighten remote access. Require MFA for VPN and remote desktop, take RDP off the internet, and check stealer-log sources for staff and supplier credentials.
- Prepare for third-party exposure. Draft customer and ICO communications now, decide who will assess any published data after 19 October, and confirm what your contracts require suppliers to tell you.
Bottom line
n0n’s maritime list is unverified, and 19 October will show what the group really holds. The pattern of small, similar data sets and missing credential matches suggests a shared supply chain platform, not 38 separate break-ins. UK businesses that ship by sea should find out which shared systems hold their data before the criminals publish it.
Sources
- SOCRadar: n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site
- The Loadstar: Cyber-crime group hits 38 shipping and port groups with data leak threat
- TrasportoEuropa: Cybercrime gang demands ransom from 38 port and logistics organisations
- Splash247: Shipping firms and ports caught in mass cyber extortion claim
