Indian maritime facility among 38 targeted by cyber extortion group? Report makes shocking claim
The Indian maritime facility was among 38 threatened by the group, named 'n0n', which has claimed it would release the data it allegedly stole, unless it is paid millions in ransom by Oct 19
The Indian maritime facility was among 38 threatened by the group, named 'n0n', which has claimed it would release the data it allegedly stole, unless it is paid millions in ransom by Oct 19.
The Indian maritime facility was among 38 threatened by the group, named 'n0n', which has claimed it would release the data it allegedly stole, unless it is paid millions in ransom by Oct 19.
The Indian maritime facility was among 38 threatened by the group, named 'n0n', which has claimed it would release the data it allegedly stole, unless it is paid millions in ransom by Oct 19.
An Indian maritime facility has found itself in a list of 37 others across the world allegedly targeted by a cyber extortion group.
The group, named 'n0n', has threatened to publish data that it allegedly stole from the 38 maritime facilities unless they pay millions in ransom by October 19.
"n0n is a financially motivated extortion group that emerged in September 2026 and monetises stolen data through public leak postings," the report said, distinguishing it from traditional ransomware deployment.
According to cybersecurity firm SOCRadar, the 'NCT Kandla'—an alleged Indian maritime facility that it lists under "container terminal operations"—was among the 38 facilities that n0n claims it added to its dark web leak site in a single batch on October 12, marking the threat group's shift to maritime targets.
However, THE WEEK could not independently verify the alleged data breaches, and has reached out to the Deendayal Port Authority (DPA) for comment.
Other facilities in n0n's alleged list spanning 18 countries include Ocean Network Express (ONE) and CULines, as well as terminal operators such as Santos Brasil and NEOM Ports.
None of the listed organisations had mentioned any such breaches either, due to which the SOCRadar report said that the cyber extortion group's claims should be treated as "unverified".
"Of the 21 victims SOCRadar tracked before the maritime wave, 19 remain at the 'Claimed' stage, one is listed as negotiating and one, Chibitek, has had data leaked," the report noted.
In any case, n0n has threatened to release the material—that it claims it stole—at 13:27 UTC (18:57 IST) on October 19, with ransom demands ranging from $2.4 million to $14 million, payable in Bitcoin.
It has also claimed that this material includes EDI archives, container manifests, vessel schedules, gate movement records, commercial documents, internal system configurations, employee accounts, and financial records, depending on the facility.
In that regard, SOCRadar has also noted that the relatively small, application-specific datasets that it claimed to have stolen from several of the victims hinted that it may have been a common application or shared vulnerability—rather than 38 separate attacks—that got n0n access to the information it claims to have, though even this is yet to be verified.