The n0n extortion crew listed 38 maritime, port and logistics organisations across 18 countries in a single batch on 12 October and gave the whole set one shared publication deadline of 13:27 UTC on 19 October. Demands reviewed by SOCRadar ran from US$2.4 million to US$14 million per company; Cydome put the aggregate at about US$1.22 billion. Named targets include Ocean Network Express, CULines, T.S. Lines, Santos Brasil, Portonave, BNCT and Pusan Newport Company in Busan, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port, NEOM Ports and crane manufacturer ZPMC. The claimed material is dominated by EDI archives — container manifests, vessel schedules, gate movements and bookings — alongside terminal operating system records and invoices. Cydome assessed the data most likely came from a single support and project archive linked to Korean maritime software vendor CyberLogitec: at least 21 of the 38 are documented CyberLogitec customers and seven sample filenames reference the vendor or its products, with file dates running from 2009 to August 2026. No listed organisation had publicly confirmed a breach, and Korea's KISA has been notifying the Korean companies named. Why it matters: when carriers and terminals share a vendor or an EDI hub, one exposure concentrates risk across dozens of operators at once.

• Source article