A ransomware and extortion group called n0n has posted data tied to 38 maritime organizations in 18 countries, and researchers say the files most likely trace back to a single software vendor, CyberLogitec. The vendor has not confirmed a breach, so the link is still an assessment, not a finding. Shipping and port operators that use the vendor’s products should check their exposure now.
What happened
According to security firm Cydome, n0n listed the batch on its leak site on October 12, 2026, with a common payment deadline of October 19. Cydome says the combined ransom demands total about $1.22 billion, with individual demands ranging from $400 thousand to $400 million. Risky Business reported on October 23 that most victims did not pay and had their data leaked; it counts more than 40 victims, while Cydome’s count is 38, so the exact number varies by source.
Cydome calls the vendor link “likely” and its assessment interim. At least 21 of the 38 listed organizations are publicly documented customers of CyberLogitec, a South Korean maritime software provider. Seven sample file names include the vendor’s name or a product name, and sample files reference products such as OPUS Terminal and ALLEGRO. Cydome’s working theory is a single support archive split up by customer. It also notes that some overlap, especially among Korean firms, could be coincidence because the vendor holds a large share of that market.
Who is affected
The listed victims include port and terminal operators and shipping-related firms. Cydome says the alleged leaked material includes user account lists with passwords, staff names, emails and phone numbers, port and terminal messaging files (EDI), system documentation, and commercial records such as tariffs, invoices and charter parties. File dates range from 2009 to August 2026. These contents are alleged and have not been independently verified.
Being named on a leak site does not by itself prove a company’s own network was breached. Per Cydome and reporting it cites from Daily Log, CyberLogitec confirmed the named Korean companies are its customers, sent them a precautionary notice, and said their systems are operating normally.
What to do
The steps below come from Cydome’s recommendations, with our own analysis where noted.
- Rotate shared and long-lived vendor credentials, and require multi-factor authentication on vendor portals and service-desk access.
- If you use CyberLogitec products, review administrator and integration accounts and check account activity from July 2026 onward.
- Warn staff to expect targeted phishing that uses leaked names, emails and shipment details (our analysis).
- Audit what your organization has sent to vendors in support tickets and file transfers, since support archives appear to be the exposed source (our analysis).
- Do not treat a listing as proof of your own breach, but do confirm with the vendor in writing what, if anything, of yours was held.
What we still do not know
CyberLogitec has not confirmed an incident, so how the data was taken, when, and from which system is not established. The final victim count differs between sources (38 versus more than 40), and the leaked data has not been independently verified.
Sources: Cydome, October 15, 2026; Hellenic Shipping News, October 19, 2026; Risky Business, October 23, 2026.
Leave a Reply