GNCNet / DGT Busan targeted by N0n ransomware group

• Ransomware group: N0n
• Country: South Korea
• Sector: Transportation
• Announcement date: October 12, 2026

N0n claims data exfiltration from GNCNet / DGT Busan

The threat actor known as N0n has officially listed the South Korean entity GNCNet / DGT Busan on its ransomware leak site. According to the announcement made on October 12, 2026, the group claims to have successfully exfiltrated sensitive information belonging to the organization. This development follows a common pattern in modern cyberattacks known as double extortion, where threat actors not only encrypt an organization's systems but also steal sensitive data to use as leverage during ransom negotiations.

In such scenarios, the attackers threaten to release the stolen information on public leak sites if their demands are not met. This tactic is designed to maximize pressure on the victim by threatening reputational damage, regulatory scrutiny, and operational disruption. While the claim of a breach has been made by the N0n group, the incident remains an allegation until further verification is provided.

Details of the ransom demand and the incident

The N0n group announced the attack on October 12, 2026, coinciding with the claimed date of the attack. The group has issued a specific ransom demand of 1.2 million USD. The threat actors have stated that if this payment is not received, they will proceed to publish the stolen data on their leak site.

The group's motivation and specific history remain unclear, as information regarding the N0n group is currently limited. Consequently, a definitive assessment regarding the group's specific motivations or their past activities cannot be made at this time. The incident highlights the ongoing risks faced by critical infrastructure providers in the digital age.

Data types involved in the alleged leak

The information allegedly stolen by the N0n group is described as being highly sensitive to the operations of the targeted entity. According to the leak site announcement, the stolen data includes sample materials that could compromise the integrity of the organization's digital services. The group has provided screenshots that show sample file names to support their claims.

The specific data types mentioned in the claim include:

• Billing service records
• Operational EDI (Electronic Data Interchange) data

The presence of such data suggests that the breach could have implications for the administrative and operational workflows of the organization and its partners.

Organization profile and potential impact

GNCNet is an organization based in Busan, South Korea, that provides information technology services for port communities. The company offers digital infrastructure solutions such as electronic data interchange (EDI) and billing systems for port operations. Given its role in providing essential IT services to the port community, the organization is a critical component of the regional logistics infrastructure.

This alleged leak may create operational risks for South Korea's logistics infrastructure. The content of the leaked data could lead to secondary risks for the organization's business partners and port operations. Furthermore, if personal data is involved in the breach, legal processes under South Korea's Personal Information Protection Act (PIPA) may be triggered.

Risk mitigation and defensive considerations

For organizations operating within the transportation and logistics sectors, such incidents underscore the importance of robust supply chain security. Because these entities often provide interconnected services, a breach in one organization can create a ripple effect across the entire logistics network. Organizations in this sector may need to review their security protocols and ensure that they are making all necessary notifications regarding a potential data breach to comply with local regulations and maintain trust with business partners.

Defensive strategies typically involve implementing multi-layered security controls, conducting regular audits of third-party access, and maintaining rigorous monitoring of data exfiltration attempts. As the threat landscape evolves, the ability to detect and respond to unauthorized data movement is becoming a primary focus for critical infrastructure protection.