A cyber extortion group is demanding ransoms of between $2.4m and $14m from 38 shipping lines, port operators and logistics companies, with a threat to publish allegedly stolen data at 13:27 UTC on October 19.

Cybersecurity firm SOCRadar reported that the group, known as n0n, added all 38 organisations to its dark web leak site in a single batch on October 12. The coordinated listing marks a sharp pivot towards maritime targets by a group SOCRadar describes as a financially motivated data-theft extortion operation rather than a conventional ransomware outfit.

None of the named companies has confirmed a breach, and SOCRadar itself stressed the claims remain unverified.

Who is on the list?

The victims span 18 countries and include:

• 12 port and container terminal operators
• 10 shipping lines and ship operators
• Port IT providers, logistics companies and other maritime businesses

Named targets include carriers Ocean Network Express, CULines, TS Lines and Samudera, alongside terminal operators Santos Brasil, Portonave, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port and NEOM Ports.

What data does n0n claim to hold?

According to SOCRadar, the datasets vary by company and allegedly include EDI archives, container manifests, vessel schedules, gate movement records, commercial documents, internal system configurations, employee accounts and financial records. Nobody has confirmed the material is genuine, complete or recently obtained.

The leak site also monetises the negotiation process itself. In one example cited by SOCRadar, Eurogate Tanger was allegedly asked to pay 10% of a $6m demand in Bitcoin before receiving access to a private negotiation room.

One breach or 38?

SOCRadar offered one notable analytical caveat: the relatively small, application-specific datasets claimed for several victims could point to a common application or shared vulnerability rather than 38 separate compromises. That hypothesis, too, remains unconfirmed.

Maritime cybersecurity company Cydome has pointed to a possible link to an environment associated with maritime software provider CyberLogitec, but it has not established the origin or the extent of any breach.

What does this mean for shippers and carriers?

For the named carriers and terminals, the immediate commercial risk sits in the data itself. Manifests, EDI archives and gate movement records can expose customer relationships, cargo flows and pricing patterns to competitors and criminals alike if published.

For shippers and forwarders, the episode is a reminder that operational data across the container chain — bookings, schedules, gate logs — may sit in shared applications and third-party environments, meaning a single weak link can ripple across dozens of operators at once.

With the October 19 deadline approaching and no company yet confirming a compromise, the sector faces days of uncertainty over whether n0n holds genuine data, and whether the threatened 13:27 UTC release will materialise.