A cyber extortion group calling itself n0n has posted claims against 38 maritime and logistics organizations on its dark web leak site, in what security researchers believe may be a supply-chain attack that reached many companies through one shared provider.
The batch, posted on October 12 with an October 19 deadline, lists 12 port and container terminal operators, 10 shipping lines and ship operators, port IT providers, logistics companies and other maritime businesses across 18 countries. Risky Business News reported that the group appears to have moved from the network of a maritime IT services provider into more than 40 port, maritime and shipping companies.
Threat intelligence firm SOCRadar, which first reported the listings, assessed that the data most likely came from a single shared application, data-exchange integration or file-transfer platform rather than dozens of separate intrusions. Maritime security firm Cydome noted that at least 21 of the 38 named companies are publicly documented customers of the same maritime software vendor, though that link has not been confirmed.
Reported ransom demands vary widely; SOCRadar put them between $2.4 million and $14 million per company. As of the latest reports, none of the listed companies had publicly confirmed that its systems were compromised or that the data is genuine.
Why it matters
Ports and shipping lines depend on tightly connected software for scheduling, customs and cargo tracking. When a shared supplier is compromised, the impact can ripple across global supply chains, which is why regulators and insurers are pushing operators to map their third-party software and rehearse how they would keep cargo moving during an outage.
Sources: Industrial Cyber, Splash247, Risky Business News.
Image: illustration created for AABEAT TV. It does not depict the people, places or products named in this story.
