A cyber extortion group has listed 38 maritime organisations across 18 countries on its leak site, with a cybersecurity analysis report published by Cydome suggesting the data may originate from a shared support archive linked to maritime software provider CyberLogitec.
The group, identified as n0n, published listings showing individual ransom demands ranging from $400,000 to $400 million. The organisations named include container shipping lines, port terminals, logistics companies and other maritime businesses, among them Ocean Network Express, Pusan Newport, Santos Brasil, Eurogate Tanger and NEOM Ports.
Research by maritime cybersecurity company Cydome found that at least 21 of the organisations are publicly documented CyberLogitec customers. An examination of 85 sample filenames published alongside the listings also identified references to CyberLogitec and its products, including its OPUS Terminal and ALLEGRO systems.
Cydome’s interim assessment is that the group may have obtained a single collection of customer support and project records and divided the material into separate listings for individual companies. The analysis remains unconfirmed, and it is not known which system was accessed, how the data was obtained or how much information relates to each organisation.
The sample filenames suggest the material may include user credentials, personal information, electronic data interchange (EDI) messages, system documentation and commercial records. The files are dated from 2009 to August 2026, and Cydome said it could not independently validate their authenticity or establish the full extent of any exposure.
The distinction is significant because being named on the leak site does not necessarily mean a company’s own network has been compromised. Some of the material may have been held in a software provider’s support environment, potentially exposing information from multiple customers and their business partners.
CyberLogitec, a Seoul-based maritime and logistics software company serving more than 150 customers worldwide, has not publicly confirmed an incident, according to Cydome’s report. Korean media have reported that the company notified named customers as a precaution and that their systems were operating normally.
The advertised demands total approximately $1.22 billion across all 38 listings. Cydome cautioned that the amounts do not establish the extent of data exposure at each company, and recommended that organisations named on the site establish the source of the data before responding to any demand.
