The n0n extortion group claims to have leaked data from more than 40 port and maritime companies across 18 countries, apparently through one shared industry software platform. A clear lesson in supplier access risk.
The shipping and port industry is dealing with one of the broadest data extortion incidents of recent years. On 12 October 2026, a ransomware and data-leak group called n0n — which only emerged in September 2026 — listed dozens of maritime companies on its dark web site at once. Risky Business reports more than 40 port operators, shipowners, ship managers and logistics firms on the list, while TrasportoEuropa counted 38 named organisations, 12 of them port and container terminal operators. Victims are spread across 18 countries.
Why this case is different
These were almost certainly not 38 separate break-ins. According to findings from security firm CyDome, roughly half of the listed companies are customers of the same vendor supplying software platforms to the maritime sector. Both Risky Business and SOCRadar assess that the data may have been pulled from shared software or a single centralised service rather than from each company individually. Suspicion has centred on a South Korean maritime software provider, but that link has not been officially confirmed and none of the listed firms had confirmed a breach at the time of reporting.
The data claimed goes straight to the operational core: EDI messages, container manifests, vessel schedules, gate movement records, bookings, equipment interchange documents and internal system configurations — alongside commercial records such as bunker cost calculations, demurrage accounts and port disbursement accounts. Ransom demands ranged from $2.4 million to $14 million per company. After the 19 October deadline passed, most victims refused to pay and their data was published.
What it means for businesses in Türkiye
Shipping agencies, ship chandlers, port service companies and the logistics offices attached to them run largely on industry-specific software: agency systems, customs and EDI integrations, fleet and voyage tracking platforms. A large share of these are administered over remote desktop, VPN or the vendor's own support connection. The lesson is blunt: a company's security level is the level of the weakest supplier it is connected to.
There is also an accountability dimension. The leaked material reportedly includes employee accounts and commercial records. Under Turkish data protection law, a leak like this triggers the company's own obligations as data controller — the duty to notify and to act does not transfer to the vendor simply because the breach started there.
What Kamer Bilişim recommends
- Inventory and restrict vendor access. Document in writing how your industry software provider connects to your network, with which account, and during which hours. Replace permanent open VPN tunnels and shared administrator accounts with on-request, multi-factor, fully logged access.
- Put backups where an attacker cannot reach them. Back up your industry application server and its database to a copy that is unreachable from the same domain — immutable or offline. Test restores with real data at least twice a year; what matters is not that a backup exists but that it comes back.
- Write a breach notification plan for the supplier scenario. Decide in advance who makes the call, which logs get reviewed, and how many hours you have to notify the authority if your data leaks through a vendor. Add a supplier breach notification deadline to your contracts.
If you would like your vendor access paths reviewed, your backup architecture checked, or help with data protection compliance in a shipping, agency or logistics office, get in touch through our contact page. We work on site across the Anatolian side of Istanbul and provide remote support elsewhere.
Source: Risky Business (23 October 2026) and TrasportoEuropa (14 October 2026)
Source: Risky Business