Massive Cyber Attack Threatens Release of Data from 38 Maritime Companies

Cybersecurity firms are alerting the maritime community to what appears to be a massive data breach possibly exposing 38 organizations ranging from shipping lines to ports, terminal operators, and agencies. According to the information, a newly emerged, shadowy “data-theft extortion operation,” n0n Group, posted the names of the 38 organizations on October 12 and gave them one week to pay millions in ransom or have their data released.

The list of companies includes the offices of major shipping lines, including Ocean Network Express (ONE) in Singapore, CULines, T.S. Lines, and companies in South Korea, Japan, and Indonesia. It also includes ports and terminals ranging from South Korea to India, Saudi Arabia, Spain, Brazil, and Vietnam. In addition to agencies supporting shipping operations, it also reaches into related businesses, including Chinese crane manufacturer ZPMC.

Not a lot is known about the group, which first emerged on the scene in September and, prior to this, has appeared to make broad opportunistic strikes according to the security firm SOCRadar. Before this, it believes the group, which is likely located in Russia, had hit a total of 21 organizations ranging from investment firms to telecommunications, retail, education, and the pharmaceutical industry in a total of 17 countries.

None of the shipping companies and others among the 38 organizations that were listed on a dark web site have publicly confirmed the attack. SOCRadar says the companies have until October 19 to make payments with Bitcoin, or their data will be published. The ransom amounts vary by the amount of data n0n claims to have, with SOCRadar saying it is between $2.4 million and $14 million, although the group indicates a willingness to negotiate with at least some of the organizations.

SOCRadar analyzed the information and believes the exposure likely came out of one shared system. It notes that n0n appears to avoid traditional ransomware development and instead manipulates a victim’s data with administration tools. The current attack seems to be centered on firms in Asia.

The breach appears to involve a narrow group of categories, reports SOCRadar, such as EDI messages, manifests, gate and equipment interchange records, terminal system configuration, release documents, and deployment material. It notes that the attack resembles other unrelated mass-exploitation extortion campaigns in 2023 and 2024, where a flaw in one widely deployed fire transfer product in a single application created the exposure.

The Israeli maritime cybersecurity company Cydome has also released an analysis of the attack. It writes, “Our assessment points to a possible compromise of a shared environment associated with CLT, a maritime software provider with documented ties to many of the named organizations. The source and scope remain unconfirmed.”

Cydome advises maritime operators, “This highlights the importance of checking supplier exposure, reviewing vendor access and assessing credentials shared through support channels.”

It is the latest in a wave of cybersecurity attacks that have hit the shipping industry in the past few years, but the first that is so widespread in nature. Several shipping lines in the past reported ransomware attacks on systems, disabling things such as their booking engines, and ports have experienced attacks that interrupted gate operations.