A dark‑web leak posted on 12 October 2026 named 38 maritime organisations as victims of an extortion campaign, and a report published on 18 October 2026 by reports says the incident is likely linked to a single third‑party vendor.
The list of targets included shipping companies, port terminal operators, container operators, logistics firms, ship managers and agents, and other maritime‑related companies spread across 18 countries.
The items appeared on the extortion group n0n’s leak site, with ransom demands reported to begin at US$400. The leak grouped victims together and attached payment demands to each listing.
reports’s coverage said investigators believe the incident can be traced back to a single vendor used by multiple affected organisations, a finding that points to a supply‑chain access vector rather than direct compromise of each company.
Scope and sectors affected
The 38 named organisations cover a broad cross‑section of the maritime ecosystem, from commercial ship operators to those providing container and terminal services, according to the report. The inclusion of companies from 18 countries underscores the transnational exposure of maritime supply chains to third‑party failures.
What is known and what remains unclear
The report sets out the date of the leak and the scale of the listings but does not identify the vendor said to be the common link, nor does it name individual victim companies. Precise details about whether data was exfiltrated, the nature of any operational disruption, or the identity of the alleged vendor were not supplied in the material available for this briefing.
The pattern described, multiple victims connected through a single supplier, is consistent with a scenario in which an attacker gains access to a widely used service or platform and leverages that foothold to enumerate and extort associated customers.
Industry observers noted in the report that such vendor‑centric incidents can rapidly broaden the footprint of an intrusion and complicate incident response, since remediation requires coordination across separate corporate infrastructures and contractual relationships.
The leak and the report together signal that maritime organisations remain attractive targets for extortion groups seeking financial gain through the exploitation of interconnected vendor relationships. Sources published the account on 18 October 2026, citing the 12 October posting on n0n’s site.
Editor profile