Korea Ferry targeted by N0n ransomware group

• Ransomware group: N0n
• Country: South Korea
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group claims attack on Korea Ferry

The threat actor known as N0n has officially listed Korea Ferry on its dedicated leak site. According to the group's announcement, they claim to have successfully gained access to the internal networks of the South Korean transportation provider. This development marks a significant escalation in the pressure placed on the organization, as the threat group has initiated a countdown for the potential release of sensitive information.

The group has reportedly issued a ransom demand of 1.200.000 USD. Furthermore, the attackers have stated that if this demand is not met, they intend to publish the organization's internal data on October 19, 2026. While the group has made these claims, public information regarding the specific identity and technical capabilities of N0n remains limited.

Details of the alleged data breach

The N0n group alleges that the stolen information includes various types of sensitive internal documentation. Based on the claims made by the threat actor, the following data types are reportedly involved in the breach:

• Staff account records
• Plaintext credentials
• Financial receipt records

The presence of plaintext credentials is particularly concerning in such incidents. In many ransomware scenarios, the theft of unencrypted login information allows attackers to maintain persistent access to a network or to move laterally to other sensitive systems. This type of exposure is a hallmark of modern cyberattacks, where the goal is not just to encrypt files, but to exfiltrate data to use as leverage in extortion attempts.

About Korea Ferry

Korea Ferry is a prominent ferry operator based in South Korea. The organization provides essential passenger and freight transportation services, with a particular focus on maritime routes connecting Busan and Japan. Given its role in regional logistics and passenger transit, the organization serves as a vital link in the transportation infrastructure of the region.

Analysis and potential impact

The alleged leak poses a high level of risk to the organization due to the specific nature of the compromised data. The exposure of staff credentials in a plaintext format is a critical security failure that could lead to secondary attacks or unauthorized access to the organization's internal systems. When attackers possess valid, unencrypted credentials, they can often bypass standard security perimeters, making the remediation process much more complex.

Furthermore, the exposure of financial receipt records carries significant implications. Such a leak could damage the organization's reputation and potentially lead to legal consequences under South Korean data protection regulations. Beyond the immediate financial and legal risks, the exposure of personal employee data creates a dangerous vector for targeted phishing attacks, where attackers use stolen information to craft highly convincing social engineering campaigns against staff members.

The combination of a ransom demand and a strict deadline for data publication suggests that the N0n group is employing a double-extortion strategy. In a double-extortion model, attackers do not merely lock the victim's systems; they also threaten to release sensitive data to force payment. This method increases the pressure on the victim by threatening their regulatory standing and public trust.

For organizations operating in the transportation sector, such incidents highlight the necessity of robust defensive measures. Implementing multi-factor authentication (MFA) can help mitigate the risk of stolen plaintext credentials being used for unauthorized access. Additionally, maintaining strict encryption standards for all stored credentials and conducting regular audits of financial record access can reduce the impact of a potential breach. Organizations must also be prepared for the regulatory complexities involving data protection laws and the potential for sophisticated phishing campaigns following a data leak.