Alarm bells are ringing again in the maritime cybersecurity sector.

According to foreign media reports, several cybersecurity firms have warned that a large-scale data breach could affect 38 shipping companies, ports, terminal operators and related organizations. An emerging “data theft extortion operation” called n0n Group published the names of these 38 organizations on the dark web on October 12 and demanded that they pay multimillion-dollar ransoms within a week, or the data would be released.

The specific list includes Ocean Network Express (ONE)’s Singapore office, as well as multiple companies in South Korea, Japan and Indonesia; the ports and terminals range from South Korea to India, Saudi Arabia, Spain, Brazil and Vietnam.

So far, none of the 38 organizations on the list have publicly confirmed that they were attacked. SOCRadar said the companies involved were required to pay in Bitcoin by October 19, or the data would be published. The ransom amount depends on the volume of data n0n claims to hold, ranging from about $2.4 million to $14 million, but the group said it is willing to negotiate with at least some of the organizations.

SOCRadar’s analysis suggests the exposure may have stemmed from a shared system. n0n appears to avoid traditional ransomware development and instead uses management tools to manipulate victims’ data. The categories of leaked information are relatively concentrated, including EDI messages, manifests, gate and equipment handover records, terminal system configurations, release documents and deployment materials. The attack resembles other unrelated large-scale exploitation and extortion campaigns in 2023 and 2024, when a widely deployed file transfer product was exposed due to a single application vulnerability.

Israel-based maritime cybersecurity company Cydome recommends that maritime operators check vendor exposure, review vendor access permissions, and assess credentials shared through support channels.