Eurogate Tanger listed on N0n ransomware leak site

• Ransomware group: N0n
• Country: Morocco
• Sector: Transportation
• Announcement date: October 12, 2026

The N0n ransomware group claims responsibility for targeting Eurogate Tanger

The threat actor known as N0n has officially listed Eurogate Tanger on its dedicated leak site. According to the group's announcement, they claim to be in possession of operational data belonging to the organization. This listing follows a pattern often seen in modern cyberattacks where threat actors utilize extortion tactics to pressure victims into paying significant sums of money.

The group has declared its intention to publish the allegedly stolen data if their demands are not met. As of the time of the announcement, information regarding the specific identity, methods, or background of the N0n group remains limited. This lack of public information is a common characteristic of emerging ransomware groups that operate with a high degree of anonymity to evade law enforcement and cybersecurity researchers.

Details of the extortion demand and timeline

The N0n group has issued a specific ransom demand of 6,000,000 USD in exchange for not releasing the stolen information. The group has set a strict deadline for this transaction, stating that if the payment is not received by October 19, 2026, the data will be exposed to the public. This type of countdown is a hallmark of double extortion, a tactic where attackers not only encrypt an organization's systems but also threaten to leak sensitive information to maximize their leverage.

In such scenarios, ransomware groups leverage the threat of reputational damage and operational disruption to coerce payments. While organizations often face immense pressure during these countdown periods, security experts frequently note that paying a ransom does not provide any guarantee that the stolen data will remain secure or that the attackers will not return with further demands in the future.

Claimed data types and evidence

The listing provided by the N0n group claims to include various sensitive documents related to the company's internal operations. Specifically, the group asserts that the stolen data contains:

• Terminal commercial operation configuration records
• Systems release documentation

To support their claims, the group provided screenshots of sample files. These files include an XML document titled '383309_MGS3_TerminalComercialOperationETC.xml' and a Word document named '524900_[PNO+MGT+WebPortal] EGT_Release Note_Release_OPUS Terminal_20230707.docx'. The presence of such technical documentation suggests that the attackers may have gained access to internal system configurations and software release notes.

About Eurogate Tanger

Eurogate Tanger is a port terminal operator located in Tangier, Morocco. The company specializes in container terminal operations and plays a vital role in the region's maritime logistics. They provide essential terminal services and logistics solutions designed to support international maritime transport and global supply chains.

Operational risks and industry implications

The potential exposure of the data claimed by N0n poses significant risks to Eurogate Tanger's operational continuity and its trade secrets. Because the group claims to have access to terminal commercial operation configuration records, there is a heightened risk that this information could be used to facilitate secondary attack vectors. In the context of critical infrastructure, such as a port terminal, the disclosure of system configuration details can provide malicious actors with a roadmap for future intrusions or disruptions to physical operations.

Furthermore, the organization may face complex legal obligations regarding compliance with data protection regulations within Morocco. Beyond the technical and legal challenges, the maritime and transportation sector remains a high-value target for ransomware groups due to the critical nature of the services provided. For organizations operating in this sector, maintaining robust security postures, implementing strict access controls, and ensuring comprehensive logging of system configuration changes are essential defensive steps to mitigate the impact of such breaches.