N0n ransomware group lists NEOM Ports (industrial port operations) on its leak site

• Ransomware group: N0n
• Country: Saudi Arabia
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group claims to have compromised NEOM Ports

The threat actor known as N0n has officially listed NEOM Ports on its dedicated leak site. According to the announcement made on October 12, 2026, the group claims to have gained unauthorized access to the organization's systems and asserts that they are in possession of sensitive commercial data belonging to the entity.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms. These sites often host announcements detailing the name of the targeted organization and, in some cases, provide proof of the theft to validate their claims. The presence of a listing on such a site indicates a high-pressure tactic used by modern threat actors to maximize the impact of their extortion attempts.

Details of the alleged extortion attempt

The N0n group has alleged that they have successfully compromised specific commercial documentation belonging to NEOM Ports. Specifically, the group claims to have stolen commercial tariff documentation and invoicing records. To support their claims of a successful breach, the threat actor has provided specific files as evidence, including '1075297_NEOM Invoice Format v1 (version 1).xlsx' and '1075726_ROPAX Charges.xlsx'.

Following the standard methodology of many contemporary ransomware operations, the group is employing a double-extortion strategy. This method involves both encrypting an organization's data to disrupt operations and stealing sensitive information to use as leverage for extortion. By threatening to release the stolen data publicly, the attackers aim to create reputational and regulatory pressure on the victim. In this specific instance, the N0n group has issued a ransom demand of 4,000,000 USD. The group has stated that if this payment is not received by the deadline of October 19, 2026, the stolen data will be published on their leak site. Information regarding the specific identity or broader history of the N0n group remains limited.

Affected data types

• Commercial tariff documentation
• Invoicing records

About NEOM Ports

NEOM Ports is an advanced industrial port and logistics hub located in the Oxagon region. It has been developed as a core component of Saudi Arabia's NEOM project. The facility serves as a modern port infrastructure specifically designed to support the region's global trade and supply chain operations.

Potential impact and industry implications

The alleged data breach involving NEOM Ports may pose significant operational and commercial confidentiality risks. The exposure of an organization's billing and tariff data could lead to a loss of competitive advantage or cause damage to established contractual relationships with third parties. Furthermore, if the ransom is not paid and the data is released to the public, the organization could face reputational harm and potential difficulties regarding compliance with relevant regulatory frameworks.

Beyond the immediate impact on the organization itself, the leakage of such specific data could potentially facilitate targeted phishing attacks against the organization's various supply chain partners. When attackers gain access to invoicing formats and tariff structures, they can craft highly convincing fraudulent communications that mimic legitimate business processes, thereby expanding the scope of their campaign.

In sectors such as transportation and logistics, maintaining the integrity of commercial data is vital for the stability of global supply chains. Organizations in this sector often implement defensive measures such as robust network segmentation, strict access controls, and continuous monitoring to mitigate the risk of unauthorized access. Additionally, regular security awareness training for employees and rigorous third-party risk management are essential components of a comprehensive cybersecurity posture designed to defend against the evolving tactics of ransomware groups.