Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
N0n
AI-generated illustration
Organisation

N0n

Data-theft extortion group that names victims on a leak site; the name uses a zero.

On 12 October, N0n listed 38 mostly maritime organisations across 18 countries and territories on its leak site; none had confirmed the group's claims when the batch was reported.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Do the maritime listings prove theft, or only show N0n's claims?

Timeline for N0n

#15 12 Oct

Listed 38 mostly maritime companies on its leak site

Cybersecurity: Threats and Defences: N0n claims 38 firms, mostly maritime
View full timeline →

Background

N0n is a data-theft extortion group that names organisations on a leak site and threatens to publish information it claims to have stolen. Its name uses a zero. The listings form part of the pressure tactic by attaching a public deadline and reputational cost to an alleged intrusion.

A leak-site post is evidence of what N0n asserts, not proof that the named organisation was breached. It does not establish how access occurred, whether files are authentic or whether several claims came through one shared supplier. Victim confirmation, technical findings or another Independent source is needed before treating a listing as a confirmed incident. N0n's origin has not been verified in the available evidence, so its public branding should not be read as reliable evidence of who operates the group or where they are based.

Key Issues
Leak claims

N0n posts one large maritime batch

On 12 October, N0n listed 38 organisations on its leak site, mostly port, terminal and shipping operators. The claims covered 18 countries and territories, and 37 entries carried the same 19 October deadline. N0n led October's leak-site count with 122 claims at that point.

The batch did not prove 38 separate intrusions. N0n attributed breaches to the listed organisations, but none of the named maritime businesses had confirmed an incident when the claims were reported. Similar data descriptions, a common deadline and the timing may suggest one shared supplier or access route, but that remains an inference. For N0n, the episode establishes the scale of its public pressure campaign, not the truth of every theft claim it posted.

Common Questions
What is the N0n extortion group?
N0n is a financially motivated data-theft extortion group that pressures named organisations through public leak-site postings rather than confirmed file encryption.Source: SOCRadar
What did N0n claim about 38 maritime organisations?
N0n listed 38 organisations across 18 countries on 12 October 2026, mostly in ports, shipping and logistics. The claims did not establish that each organisation suffered a separate breach.Source: SOCRadar
Why are N0n's maritime claims still unverified?
No listed maritime organisation had publicly confirmed an incident when SOCRadar published. A leak-site listing alone does not prove intrusion or theft.Source: SOCRadar
How might N0n have obtained the maritime data?
The access route is unconfirmed. SOCRadar found that repeated data types and one shared deadline pointed towards a common application or access path rather than 38 proven separate intrusions.Source: SOCRadar
Source Material

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.