N0n ransomware group lists MGNP (port terminal operations) on its leak site

• Ransomware group: N0n
• Country: South Korea
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group claims data breach at MGNP

The N0n ransomware group has listed the South Korean port terminal operator MGNP on its leak site, claiming to have compromised the organization's commercial data. According to the announcement made on October 12, 2026, the threat actor asserts that it has successfully infiltrated the company's systems, leading to the alleged theft of sensitive business information.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak stolen data on public forums or dedicated leak sites, cybercriminals attempt to pressure victims into paying ransoms to prevent reputational damage or regulatory scrutiny. In this instance, the group has set a deadline for payment to prevent the public release of the stolen materials.

Details of the alleged attack and ransom demand

The threat actor known as N0n claims to have obtained specific commercial records belonging to MGNP. The group has issued a ransom demand of 800,000 USD to the organization. The attackers have stated that if the specified payment is not met, the stolen data will be published on October 19, 2026.

Information regarding the N0n ransomware group remains limited in the public domain, as there is little available data concerning their specific tactics, techniques, or overall operational history. This lack of public information is common with emerging or niche ransomware groups that operate with a degree of anonymity to evade detection and attribution by security researchers.

Alleged stolen data types

The group claims to have exfiltrated several types of sensitive business information, specifically focusing on financial and administrative documentation. The materials identified in the claim include:

• Commercial invoice records
• Billing system materials

Organization profile

MGNP is a port terminal operator based in South Korea. The company operates in the field of port operations and logistics services, making it a key player in the regional transportation and supply chain infrastructure.

Potential impact and industry considerations

The alleged incident may pose significant risks to the organization's financial processes and commercial confidentiality. The potential leak of invoice data could lead to secondary risks for the organization's business partners and its broader supply chain, as third parties may be targeted based on the information stolen from the primary victim.

Furthermore, under South Korea's Personal Information Protection Act (PIPA), the organization may face mandatory data breach notification requirements. If the ransom is not paid and the data is released publicly, the organization could suffer lasting damage to its reputation and may become a target for secondary attacks, such as highly targeted phishing campaigns aimed at employees or clients using the leaked details.

For organizations operating within the transportation and logistics sectors, maintaining robust cybersecurity postures is critical. Common defensive steps to mitigate such risks include implementing strict access controls, maintaining offline backups of critical financial and operational data, and conducting regular security audits. Additionally, organizations should be prepared to follow legal frameworks regarding data breach notifications to ensure compliance with national regulations like PIPA.