N0n ransomware group lists ZPMC (port machinery and terminal engineering) on its leak site

• Ransomware group: N0n
• Country: China
• Sector: Manufacturing
• Announcement date: October 12, 2026

N0n ransomware group claims data breach at ZPMC

The N0n ransomware group has published a ransom notice on its leak site, claiming to have compromised sensitive data belonging to ZPMC. According to the announcement made on October 12, 2026, the threat actors assert they have successfully breached the organization's systems and are now engaging in a double extortion tactic. In such scenarios, cybercriminals typically steal sensitive information before encrypting systems, using the threat of public disclosure to pressure the victim into paying a ransom.

The threat actor has stated that they will proceed to publish the stolen data if a ransom demand of 160,000,000 USD is not met. To support their claims regarding the breach, the group has provided sample files on their leak site for public viewing. While the group has made these claims, the incident remains an allegation by the threat actor.

Details of the alleged theft

The N0n group claims to be in possession of specific operational and logistics-related files. The information they assert to have stolen includes:

• Operational EDI archives
• Cargo loading records

The exposure of such data, particularly Electronic Data Interchange (EDI) archives, is significant in industrial sectors. EDI is a standard format for the electronic exchange of business documents between business partners. When these archives are compromised, it can reveal intricate details regarding supply chain processes and commercial partnerships, potentially exposing the internal workflows that connect various global entities.

About ZPMC

ZPMC (Shanghai Zhenhua Heavy Industries Co., Ltd.) is one of the world's largest manufacturers of container cranes and heavy equipment, specializing in port machinery and engineering. The company operates globally in the fields of port automation, marine engineering, and logistics equipment.

Potential impact and industry implications

This alleged data breach may pose risks to the organization's operational continuity and the confidentiality of its logistics data. The exposure of EDI archives could lead to the disclosure of supply chain processes and commercial partnerships. Such an incident may damage the organization's commercial reputation and increase the risk of secondary attacks targeting third parties who interact with the organization's logistics network.

For organizations operating in the manufacturing and heavy engineering sectors, such incidents highlight the importance of robust data protection measures. When sensitive logistics and operational data are leaked, it can create a ripple effect throughout the supply chain, as third-party partners may become targets for follow-on attacks. Furthermore, legal processes may be triggered under the data protection regulations applicable in the region where the organization operates.

While information regarding the N0n group remains limited, this incident underscores the evolving nature of ransomware threats. Organizations typically defend against such threats by implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to identify vulnerabilities in their network perimeter. The complexity of global logistics makes the protection of EDI and cargo-related records a critical component of modern industrial cybersecurity strategies.