n0n Ransomware CyberLogitec Supply Chain Attack Explained: $1.2 Billion Demanded from 38 Maritime Companies

Illustrative image: Wikimedia Commons / James R. Tourtellotte, public domain (aerial view of a container port — the sector n0n targeted)

TL;DR: The n0n ransomware CyberLogitec supply chain attack explained in plain terms: a new extortion group listed 38 shipping and port companies on its dark-web leak site on 12 October 2026, demanding about $1.22 billion in total. Researchers at CyDome assess the stolen data came from one vendor's customer archive — but the link is not confirmed. Here is what happened, what is verified, and what it means for you.

📌 Key Highlights

• On 12 October 2026, the new extortion group n0n published 38 maritime organisations on its leak site — shipping lines, port terminals, logistics firms and ship managers across 18 countries.
• Ransom demands ranged from $400,000 to $400 million per company, totalling roughly $1.22 billion; the payment deadline expired on 19 October 2026.
• CyDome's interim assessment (15 Oct): at least 21 of the 38 are documented customers of CyberLogitec, a Seoul maritime IT vendor — the data may come from a single vendor support archive, not 38 separate breaches.
• CyberLogitec has not publicly confirmed an incident; the sample data's authenticity is unverified and some files are years old.
• After the deadline passed, n0n followed through: downloadable archives appeared against 12 Korean firms (reported 20 October).

What happened?

n0n is a newcomer. The group surfaced in September 2026 and spent its first month hitting 21 organisations across 17 countries. Then it pivoted hard. On 12 October, it dropped a single batch listing 38 maritime organisations on its dark-web leak site — container shipping lines, port terminal operators, logistics companies, ship managers and port authorities spanning North and South America, Europe, Asia and Australia.

Unlike classic ransomware crews, n0n does not appear to encrypt anything. It steals data and monetises the threat of publication — pure extortion. Each listing carried its own ransom demand and the same deadline: 19 October 2026, 13:27 UTC. Most victims refused to pay, and their data started appearing on the leak site.

Named victims include Ocean Network Express, Pusan Newport, Santos Brasil, Eurogate Tanger and NEOM Ports, plus Brazil's Superterminais and India's NCT Kandla terminal.

The n0n Ransomware CyberLogitec Supply Chain Attack: The One-Vendor Theory

The twist: at least 21 of the 38 organisations are documented customers of CyberLogitec, a South Korean maritime IT vendor, and seven of n0n's 85 sample filenames reference its products — OPUS Terminal and ALLEGRO — directly.

CyDome's interim assessment: the stolen material probably comes from a single support and project archive tied to CyberLogitec, which n0n split into 38 separate "victim" listings with individual ransom demands. That would mean there were never 38 breaches — there was one door, and the vendor's shared software layer was it.

Fact	Detail
Group	n0n — new extortion group, surfaced Sept 2026; data theft for publication threat, no encryption seen
Batch listed	12 Oct 2026 — 38 maritime organisations, 18 countries
Demands	$400k – $400M per listing; ~$1.22B total
Deadline	19 Oct 2026, 13:27 UTC (expired)
Assessed source	Single vendor archive linked to CyberLogitec (CyDome interim — unconfirmed)
Data seen in samples	EDI messages, manifests, credentials, PII, system documentation
Follow-through	After the deadline, downloadable archives appeared against 12 Korean firms
Vendor status	Not publicly confirmed; precautionary customer notice; systems normal

Illustrative image: Wikimedia Commons / Trougnouf, CC BY 4.0 (container cranes at a European terminal)

What is confirmed — and what is not

Credit where it is due: CyDome is explicit that this is an interim assessment, not a confirmed finding. We do not know which system was accessed, how, or how much data was taken. The samples' authenticity cannot be independently validated, and some files date back years. Not one of the 38 organisations has publicly confirmed a breach of its own network.

CyberLogitec has not publicly confirmed an incident; Korean press reports a precautionary customer notice, with systems operating normally. South Korea's KISA has notified affected firms. Treat the CyberLogitec connection as assessed by researchers, not proven — the pattern is strong, the proof is pending.

Why it matters for World Tech readers

Risky Business calls this one of the largest cyberattacks to hit the maritime sector since NotPetya in 2016 — and it carries the same lesson as every great supply-chain incident: you can harden your own network perfectly and still be breached through a vendor's archive. Compare it with the malicious LiteLLM release that smuggled a credential stealer onto PyPI or the Storm-0940 intrusion through ConnectWise Cloud Backup — the entry point was someone else's infrastructure.

There is also an India connection: NCT Kandla, a container terminal operation, sits on n0n's list. And the data involved — EDI messages, manifests, gate records — is exactly the kind of operational data ports and logistics firms share with software vendors daily. Once exposed, credentials in those samples feed the phishing and fraud campaigns seen in the SBI customer data leak on the dark web.

Should you care? ✅ / ⏳

✅ If your company uses CyberLogitec products (OPUS Terminal, ALLEGRO, or EDI/file-transfer tooling): treat this as real until proven otherwise. Ask the vendor whether it is investigating, review vendor access to your systems, and rotate any credentials that were shared with the vendor's support teams.

⏳ If you are just a reader: no action needed — but bookmark the pattern. The next NotPetya-scale event is more likely to enter through a vendor than through your own firewall.

FAQs

What is the n0n ransomware group?
A new data-extortion group first observed in September 2026. It does not appear to encrypt files; it steals data and demands payment to stop publication on its dark-web leak site. The October batch of 38 maritime victims is its largest operation to date.

How much ransom did n0n demand from the maritime companies?
Demands ranged from $400,000 to $400 million per listed company, totalling roughly $1.22 billion, according to CyDome. Most refused to pay, and their data began appearing on the leak site after the 19 October deadline.

Is CyberLogitec confirmed as the source of the n0n attack?
No. CyDome's interim assessment says the data is likely linked to a CyberLogitec support/project archive — 21+ victims are documented customers and sample filenames reference its products — but the link is not confirmed, and CyberLogitec has not publicly confirmed an incident.

Which companies were named in the n0n maritime leak?
The 38 listings span 18 countries and include Ocean Network Express, Pusan Newport, Santos Brasil, Eurogate Tanger, NEOM Ports, Superterminais (Brazil) and NCT Kandla (India), among container shipping lines, port terminals, logistics companies and ship managers.

Takeaway

Thirty-eight victims, $1.2 billion in demands, and possibly one vendor's archive behind it all. The n0n case is a warning written in shipping containers: map what your vendors hold, and ask them hard questions before the attackers do.

For a second backup-destroying ransomware operation hitting hundreds of organisations, read our safepay ransomware 600 organizations explained breakdown of the FBI-CISA joint advisory AA26-293A.

Follow World Tech on TechByCountry for tomorrow's 6 PM update.

Sources

• CyDome — n0n Cyber Extortion Incident: 38 Maritime Companies Likely Trace Back to a Single Vendor (15 Oct 2026) (primary research)
• Risky Business — Supply chain attack lets ransomware group inside 40+ shipping companies (23 Oct 2026)
• Smart Maritime Network — Cyber group lists 38 maritime organisations with $1.22bn in ransom demands (20 Oct 2026)
• Regula Shipping — n0n publishes data on 12 Korean maritime firms after the 19 October leak clock (20 Oct 2026)