38 global maritime companies reeling from the threat of a data leak
Recently, the international maritime community received a red alert from cybersecurity experts regarding the risk of digital asset leaks. Dozens of organizations across the industry, large and small, are falling victim to a large-scale extortion campaign. The hacker group is threatening to release troves of sensitive data if these companies refuse to pay massive ransoms.
Unprecedented scale: From international shipping lines to seaports in Vietnam
According to information from cybersecurity firms, this maritime industry leak affects 38 different organizations. The list of victims spans well-known shipping carriers such as Ocean Network Express (ONE - Singapore), CULines, and T.S. Lines to numerous enterprises in South Korea, Japan, and Indonesia.
Not stopping at shipping lines, the hackers' targets also include seaports and terminal operators across multiple countries, including South Korea, India, Saudi Arabia, Spain, Brazil, and Vietnam. Even a major Chinese crane manufacturer, ZPMC, and several shipping agencies are in the crosshairs. Nevertheless, as of now, none of the companies on the list have officially confirmed being attacked.
Profile of the hacker group n0n Group and the multi-million USD ultimatum
Behind this extortion is an organization named "n0n Group". Cybersecurity platform SOCRadar stated that despite only emerging on the scene in September, the group has already carried out multiple attacks targeting 21 organizations across 17 countries in the telecommunications, retail, education, and pharmaceutical sectors. Experts suspect the group is based in Russia.
On October 12, n0n Group published a list of 38 maritime companies on a dark web site and issued an "ultimatum": Victims have exactly one week (until October 19) to pay ransoms in Bitcoin cryptocurrency, or their data will be widely leaked. Depending on the volume of information held, the amount demanded by the hackers ranges from 2.4 million to 14 million USD per company. However, the group also expressed a willingness to "negotiate" with some organizations.
Where did the data vulnerability originate?
Instead of using traditional ransomware to lock victims' computers, n0n Group used system administration tools to silently gain control and steal information.
Experts believe that the leaked data was not caused by individual attacks on each company, but originated from a vulnerability in a system shared by multiple enterprises. The attack primarily targeted companies in Asia and stole data specific to the maritime sector, such as: electronic exchange messages, cargo manifests, equipment records, and customs clearance documents.
Echoing this view, maritime cybersecurity firm Cydome (Israel) assessed that the cause may stem from shared software belonging to "CLT" – a software vendor linked to many organizations on the victim list. However, the exact origin and scope of this vulnerability are still being verified.
A wake-up call on threat of data leak for the maritime supply chain
The shipping industry is no stranger to cybersecurity risks. Over the past few years, many shipping lines and seaports have experienced paralysis of their booking systems or disruptions to gate operations due to malware. Yet, this is the first time a data theft has occurred so simultaneously and extensively.
Amid escalating risks, Cydome issued an urgent recommendation: Maritime operators must immediately review partner access permissions, check the security posture of service providers, and reassess credentials being shared internally.
The incident involving the 38 maritime enterprises is clear proof that close ties within the technology supply chain can also become a fatal "Achilles' heel." As the ransom payment deadline draws near, the tech community and businesses are holding their breath to see whether n0n Group will actually bring this top-secret data to light.
Reference: Maritime Executive - Massive Cyber Attack Threatens Release of Data from 38 Maritime Companies
