Pusan Newport Company listed by N0n ransomware group

• Ransomware group: N0n
• Country: South Korea
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group claims data breach at Pusan Newport Company

The ransomware group known as N0n has listed the South Korean organization Pusan Newport Company on its leak site. The group claims to have successfully exfiltrated sensitive operational data belonging to the company. This announcement, made on October 12, 2026, follows a claimed attack date of the same day. While the group has made these claims, information regarding the specific identity and background of the N0n group remains limited in the public domain.

Details of the alleged extortion attempt

According to the claims made by the N0n group, the organization is being targeted in a double extortion scheme. In such scenarios, threat actors typically steal sensitive information before encrypting systems, using the threat of leaking the data to pressure the victim into paying a ransom. In this specific instance, the group has demanded a ransom of 12,000,000 USD. The attackers have issued a deadline, stating that the stolen data may be published on October 19, 2026, if the financial demands are not met.

To demonstrate the validity of their claims and provide proof of the breach, the group has released two sample files. These files include an Excel spreadsheet titled '620322_Deploy List(2024-04-08)(UAT).xlsx' and a PDF document named '76973_Full_200695.pdf'. The release of these samples is a common tactic used by ransomware groups to increase pressure on the victim by proving they possess actual corporate documentation.

Compromised data types

The announcement from the N0n group specifies that several types of sensitive information have been compromised. The breach allegedly includes records related to the deployment and configuration of terminal operating systems, which are critical to port logistics. Additionally, the group claims to possess various operational container documentation. The specific items identified as affected include:

• Terminal operating system configuration records
• Operational container documentation