On 12 October 2026, the cyber extortion group n0n listed a batch of 38 maritime organizations on its dark web leak site. The targets include shipping companies, port terminal operators, container operation companies, logistics companies, ship managers and agents, and other maritime-related companies in 18 countries. The listings carry ransom demands ranging from USD 400 thousand to 400 million per company, almost all with the same deadline: 19 October 2026, 13:27 UTC.

Cydome’s research team analyzed the available information on this incident and assessed that it is likely linked to data from CyberLogitec, a Korean company that provides software and IT services to maritime companies. At least 21 of the 38 companies are publicly documented CyberLogitec customers, and other details in the 85 sample files published by n0n also point to CyberLogitec as the source.

While we continue to analyze the incident, our interim assessment is that the stolen data may come from a single source, a support and project archive that originated at, or is linked to, CyberLogitec and relates to its customers. Rather than 38 different breaches, n0n appears to have split the data into separate “victims” parts and set an individual ransom demand for each customer. This is not confirmed, and reflects what the available information shows so far. We do not know which system was accessed, how, or how much of each customer’s data was taken.

We checked the available data, and while we cannot validate its authenticity, we have indications that the stolen data contains sensitive information, such as passwords and personal information. Some of it is dated to several years ago, so it is not necessarily current. Everything in this analysis should be read as alleged.

Key Findings

• On 12 October 2026, n0n listed 38 maritime organizations in 18 countries, with demands totaling about USD 1.22 billion and a common deadline of 19 October 2026, 13:27 UTC.
• At least 21 of the 38 victim organizations are publicly documented CyberLogitec customers, and 7 sample file names include the vendor’s name or one of its product names.
• Our interim assessment is that the data likely comes from a single support and project archive linked to CyberLogitec, split into separate listings per customer.
• The samples indicate credentials, personal data, EDI traffic and system documentation, with file dates from 2009 to August 2026.
• Being named on the list does not necessarily mean an organization’s own network was breached.

Who Is n0n

n0n first surfaced on 18 September 2026. The researchers who documented the group reported that it gets in with credentials stolen by infostealer malware. Several of its September listings were service providers whose listings advertised their clients’ data, in industries such as financial services, technology, retail and education.  Some threat intelligence vendors list n0n as likely Russia-based, but we have not seen the evidence behind this assessment, and we do not attribute the group to any country (although, there is some evidence that they are not related to Iran, China or North Korea).

The October 12 Maritime Listings

The maritime listings appeared in a single batch on 12 October, according to ransomware.live. Names on the list include the likes of Ocean Network Express, Pusan Newport, BNCT, Santos Brasil, TTI Algeciras, Eurogate Tanger, NEOM Ports and ZPMC.

In South Korea, BoanNews reported that KISA, the national cyber agency, notified the Korean companies on the list. Dongkuk Steel told NGetNews it could not confirm actual damage. Korean logistics outlet Daily Log reported that CyberLogitec confirmed the named Korean companies are its customers and sent them a precautionary notice, and that their systems are operating normally.

n0n has followed through on earlier deadline threats. On 13 October, it replaced several anonymous listings with the victims’ real names within hours of their deadlines passing. We suggest treating the 19 October deadline as a real threat.

As a side note, most of the deadlines are listed to be at 13:27 UTC, with one at 13:19 UTC. This corresponds to verses from the Gospel of John, where Jesus tells Judas Iscariot at the Last Supper, right after Satan enters him, “What you are about to do, do quickly,” [13:27] and “Now I tell you before it come, that, when it is come to pass, ye may believe that I am he.” [13:19]. This could be an indication that the n0n group is Christian in origin.

Tracing the Common Source to CyberLogitec

CyberLogitec and Its Products

CyberLogitec is a Seoul-based maritime and logistics software company. It belongs to EUSU Holdings, a Korean holding group that also owns EUSU Logistics, one of the listed organizations. Terminal operators, container lines, bulk and tanker operators and logistics companies use its software:

• OPUS Terminal is a terminal operating system (TOS). Terminal operators use it to plan berths, vessels and yard space, control container moves and gate transactions, and bill their customers. OPUS Terminal M is a cloud version for smaller terminals.
• ALLEGRO is a liner operations system for container ship lines. It covers bookings, bill of lading documentation, container and equipment management, vessel schedules and billing.
• OPUS Bulk manages voyages for dry bulk and tanker operators, from voyage estimates and chartering to operations, laytime, demurrage and voyage accounting.
• CARA is a cloud service that container lines use to review and manage special cargo, such as out-of-gauge cargo and dangerous goods.
• OPUS D&D calculates and invoices demurrage and detention charges, based on each carrier’s tariffs and free time.

The company also provides IT infrastructure managed services and EDI management to port terminals, and runs a 24/7 global service desk through its Vietnam subsidiary. It reports more than 150 customers worldwide.

The materials published by n0n include specific references to CyberLogitec, along with what appear to be customer emails, support tickets, sample EDI files, release notes and other correspondence typical of customer support.

Customer Overlap

We checked each organization on the list against press releases, trade press and EUSU Holdings investor materials.

Figure 1. Relationship of each listed organization to CyberLogitec. Source: Cydome research, October 2026 · based on press releases, trade press and EUSU Holdings investor materials

The documented customers span 9 countries and all of the products mentioned earlier. File names on two more listings refer to CyberLogitec or its products. CyberLogitec has a large share of the Korean market, so some of the Korean overlap could be coincidence, but the list also includes its customers in Brazil, Spain, Morocco, Saudi Arabia and Indonesia.

To our knowledge, so far CyberLogitec has not confirmed an incident in this case.

Sample File Analysis

Each listing includes 2 or 3 sample files. We reviewed the names of all 85. The main ones are below.

Table 1. Selected sample file names from the n0n maritime listings

Listing	Sample file (as published)	What the name suggests
BKH ICD	(CLT-OTM) Release Note_PKT_20250327.pdf	A vendor release note that names CyberLogitec (CLT) and OPUS Terminal M
Eurogate Tanger	EGT_Release Note_Release_OPUS Terminal_20230707.docx	A release note for the vendor’s OPUS Terminal product
Pusan Newport	Deploy List(2024-04-08) (UAT).xlsx	A deployment list for a test environment
Kambara Kisen	Allegro Seacast CSV June.2024	Refers to the vendor’s ALLEGRO product
CULines	CUL-ALG-ITO_CULSD-4053_FS_v1.0.docx	A functional specification with a ticket key
Asyaport	ASYM-1747_01ADD-COLUMN-TOSADM… .sql	A database patch script with a ticket key
TTI Algeciras	Enhancement – [EDI] COPRAR – Decimals in weight	A support request for an EDI change

Figure 2. Leak-site listings for CULines and Ocean Network Express, as captured by ransomware.live. CULines’ sample files reference the vendor’s ALLEGRO product. ONE’s listing carries a $400 million demand.

Some file name patterns repeat across customers in different countries. 7 file names include the vendor’s name or one of its product line names. Several carry what appears to be ticket keys made of a customer code and a number. Table names in files from Turkey and Korea follow the same naming convention. Many names end with a 5-digit sequence, which is consistent with an export from a ticketing or mail system. The dated file names run from 2009 to August 2026.

In one case, a listing reuses a file from another listing. GlobalNet LCL’s listing includes the same sample file as the April Asia listing, with the same catalog number and an identical description. This suggests that being named on the list does not always mean an organization’s own data was taken.

Assessed Data Exposure

Based on the file names, the listing descriptions and our review of the available data, we found indications that the archive could include:

• Credentials and personal data. We have indications that the data includes user account lists with passwords, and staff details such as names, email addresses and phone numbers. These examples are dated from 2018 to 2022, so they are not necessarily current.  Some listings also refer to infrastructure records, such as server and network information, from several years ago.
• EDI traffic. Stowage plans (BAPLIE), bookings (COPARN), gate moves (CODECO) and loading lists (COPRAR). These messages often carry data about other carriers. One terminal’s sample includes a gate-move file for ONE, and Yusen’s includes HMM tariffs.
• System and implementation material. Release notes, deployment lists, data migration specifications, interface specifications and database patch scripts. These reveal system versions, table structures and interface details.
• Commercial records. Tariffs, invoices, charter parties, port disbursement accounts and demurrage calculations.

Note that these are indications only. We cannot confirm the scope of the breach or the authenticity of the information, although we did not find any flaws that would indicate fake data.

Even outdated information can be misused. People often reuse passwords or change them only slightly, and real names, roles, and email addresses make phishing messages more convincing.

Exposure may also reach beyond the 38 names. Carriers and partners whose messages pass through a listed terminal could appear in the data without being listed.

Ransom Demand Structure

Each listing shows a settlement amount, its individual bitcoin address (for payment), and a one-time option to pay 10% of the full ransom price to open a negotiation room.

Across all 38 listings, the demands add up to about USD 1.22 billion, with individual listings ranging from USD 400,000 to 400,000,000.

Figure 3. Advertised demand per listing Source: n0n leak site via ransomware.live, 13 to 15 Oct 2026 · all 38 maritime listings

4 listings carry demands of USD 100 million or more: Ocean Network Express ($400 million), Apical Group ($320 million), ZPMC ($160 million) and Dongkuk Steel ($100 million). The amounts rise with company size, regardless of what the sample files contain. Some figures reported in the Korean press, such as $10 million for Dongkuk Steel, match the 10% negotiation option rather than the full demand.

Assessed Attack Scenario and Open Questions 

One explanation that fits the evidence so far is a single archive from CyberLogitec’s support environment, split by customer name. n0n used a similar approach in September, when it listed service providers along with their clients’ data. This is still a hypothesis. Figure 4 marks the steps that are not verified.

Figure 4. Assessed attack scenario. Cydome assessment, October 2026 · hypothesis, not a confirmed sequence

n0n is a new group, first seen less than a month before this batch. We do not know whether it stole the data itself or acquired it from a third party, for example, by buying it from other hackers. The file dates range from 2009 to August 2026. Older material could have been taken earlier and later sold or passed on, so both options remain open.

Open questions remain: which system held the data (the vendor’s own, or a third-party ticketing or mail platform), who took it and how, and how much of it relates to each named organization.

Recommendations for Maritime Operators 

We recommend that maritime organizations:

1. List every vendor support and remote-access account, including shared service-desk logins, and rotate shared or long-lived credentials, especially passwords that have not changed in years.
2. If you use CyberLogitec products, review admin and integration accounts in those systems first.
3. Review CyberLogitec account activity from July 2026 onward. File names refer to dates as recent as August 2026.
4. Warn operations, IT and finance teams about targeted phishing. Real ticket numbers, engineer names, EDI samples and invoice templates make convincing lures. This is true even if your organization is not on the list, as those details may be hidden within the stolen data.
5. Check what your organization has sent to software vendors, especially CyberLogitec, by email or tickets over the years. Look for sensitive information such as credentials, network diagrams, database exports and configuration files.
6. Require MFA on vendor portals and service-desk access, and add breach notification terms to vendor contracts.
7. If your organization is named, do not treat the listing as proof that your own network was breached. Establish where the data came from before responding to any demand.
8. Monitor IT and OT networks for unusual activity, so that misuse of leaked configuration or credentials is caught early.

 

Cydome’s maritime cyber experts are available to support with responding to, or preventing, this threat.

Conclusion 

Software vendors that serve ports and carriers often hold years of support correspondence, EDI configurations, billing data and user lists for their customers. If one of their support environments is compromised, many customers can be exposed at once, even if their own networks were never touched.

We saw a similar pattern in the second wave of the Lab Dookhtegan campaign, where disruption across many tankers traced back to a single satellite service provider, and in previous incidents where a breach at a single maritime service provider affected the operations of many of its customers.

Cydome is following this campaign ahead of the 19 October deadline. If you work with any of the named organizations or use CyberLogitec systems, book a short exposure review with our team.