N0n claims 38 firms, mostly maritime

On 12 October a data-theft group called N0n listed 38 companies from 18 countries and territories on its leak site (the web page where extortion groups name victims and threaten to publish their files) in a single batch, most of them port, terminal and shipping operators⁠¹. Of the listings, 37 carry the same deadline, 19 October at 13:27 GMT⁠². South Korea supplied 12, including Busan terminal operators; others sit in Indonesia, Brazil, China, Singapore, India, Morocco, Spain, Germany and the UK. The list includes a Hamburg port consultancy, a Brazilian terminal-systems firm, a Saudi port operator and Kuwait's port community system operator (the system shippers, customs and terminals use to exchange cargo paperwork). Trade reports put the demands at $2.4m to $14m in Bitcoin, and no listed company had confirmed a breach⁠³.

These are criminal claims, and none is verified. The listings claim the same data in every country: database scripts from the software that runs terminal yards, records of containers entering and leaving and of damage, dangerous-goods records, voyage and fuel data. One batch, one clock and one data shape across 18 countries and territories fit a single shared point of compromise, such as a common supplier or software platform, better than 38 separate break-ins. That reading rests on the listing pattern alone: no victim or investigator has confirmed it, and nothing in the listings shows which supplier, if any, was involved.

The batch put a newcomer on top of the October board. ransomware.live, a public tracker of leak-site posts, counted 680 leak-site claims from 1 to 21 October by discovery date, each one an organisation threatened with publication, with N0n on 122 and The Gentlemen on 85⁠⁴. The Gentlemen split from Qilin's affiliate programme, the hired hackers who rent its ransomware for a cut; N0n posted 18 claims in September. By the date the tracker found each post, September had 783 claims. The 815 we reported for September used a different count, and late finds have since pushed the raw September file to 831. Either way, October is on course to pass it.

Threat-intelligence firm SOCRadar classes N0n as data-theft extortion rather than encrypting ransomware, so its total counts threatened exposures, not locked networks⁠⁵.