Saehan Marine targeted by N0n ransomware group

• Ransomware group: N0n
• Country: South Korea
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group claims attack on Saehan Marine

The threat group known as N0n has claimed responsibility for a cyberattack targeting Saehan Marine, a maritime services provider based in South Korea. According to an announcement made on the group's leak site on October 12, 2026, the attackers claim to have compromised sensitive organizational data. The group has issued a ransom demand as part of their extortion attempt, threatening to release the stolen information if their financial demands are not met.

Ransomware attacks of this nature often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The attackers then use the threat of leaking this data on a public leak site to pressure the victim into paying a ransom. This method significantly increases the leverage held by the cybercriminals, as the risk of public exposure can cause lasting damage to a company's reputation and business relationships.

Details of the extortion attempt

The N0n ransomware group listed Saehan Marine on their dedicated leak site, officially announcing the breach. The group has set a deadline for the payment, stating that if a ransom of 400,000 USD is not paid, the stolen data will be released publicly on October 19, 2026. While the group has made these claims, information regarding the specific identity and capabilities of the N0n group remains limited.

The group's threat to publish the data highlights the growing trend of ransomware-as-a-service (RaaS) and specialized leak sites used by various threat actors to monetize stolen information. These sites serve as a public shaming mechanism, designed to maximize the psychological and financial pressure on the targeted organization. By setting a specific date for the data release, the attackers attempt to create a sense of urgency to compel the victim toward a quick settlement.

Reported affected data

The information allegedly stolen during the breach includes specific documentation related to the company's financial and administrative maritime operations. The data identified in the claim includes:

• Port disbursement account records
• Banking correspondence templates

The exposure of such documents can be highly problematic for organizations involved in international trade and logistics. Banking templates and correspondence can be exploited to facilitate sophisticated business email compromise (BEC) or phishing attacks, where attackers impersonate legitimate entities to redirect funds or gain further access to financial systems.

About Saehan Marine

Saehan Marine is a ship agency company based in South Korea. The company operates in the field of port operations and related maritime services, providing essential logistical support within the maritime sector.

Potential impact and industry implications

This alleged leak targeting Saehan Marine may pose significant risks to the company's financial operations and commercial confidentiality. The reported exposure of port disbursement records and banking templates could negatively impact the company's business relationships and financial processes. Furthermore, the disclosure of such financial data could facilitate secondary phishing attacks against the company's supply chain partners and may lead to significant reputational damage.

As a company operating in South Korea, Saehan Marine may face legal obligations under the Personal Information Protection Act (PIPA) following such an incident. Regulatory frameworks like PIPA impose strict requirements on how organizations must protect data and how they must respond to breaches to ensure the privacy of individuals and the integrity of the market.

For organizations operating in the transportation and maritime sectors, such incidents underscore the importance of robust cybersecurity frameworks. To mitigate the risks associated with ransomware and data exfiltration, companies often implement defensive measures such as multi-factor authentication (MFA), regular offline backups, and strict network segmentation. Additionally, continuous monitoring of financial correspondence and enhanced training for employees to recognize phishing attempts are critical steps in defending against the secondary attacks that often follow a data breach.