Samjoo Maritime targeted by N0n ransomware group

• Ransomware group: N0n
• Country: South Korea
• Sector: Transportation
• Announcement date: October 12, 2026

N0n ransomware group targets Samjoo Maritime

The threat actor known as N0n has listed Samjoo Maritime on its leak site, claiming to possess internal data belonging to the company. This announcement, made on October 12, 2026, marks a significant targeted attack against the South Korean maritime services provider. The group has issued a ransom demand of 600,000 USD in exchange for the return of the data or to prevent its public release.

The group has employed a tactic often referred to as double extortion. In these types of cyberattacks, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The goal is to increase pressure on the victim by threatening to publish the stolen data on a public leak site if the ransom is not paid. This method significantly increases the leverage of the attacker, as the victim faces the risk of reputational damage and regulatory scrutiny even if they can restore their systems from backups.

Details of the alleged breach

According to the claims made by the N0n group, the breach involves the theft of internal financial records. The threat actor has specified that the compromised information includes various sensitive documents used in the company's daily operations. The specific types of data claimed to be involved include:

• Financial records
• Expense applications
• Bunker cost calculations

The group has set a deadline for the payment, stating that if the ransom is not met, the data may be published on October 19, 2026. It is important to note that public information regarding the N0n group remains limited, making it difficult to ascertain their specific technical methods or long-term objectives beyond this current extortion attempt.

About Samjoo Maritime

Samjoo Maritime is a ship management and maritime services company based in South Korea. The company operates in several critical areas of the maritime industry, including ship operations, technical management, and crew management. As a provider of essential maritime services, the company plays a role in the logistical and operational stability of maritime transport.

Analysis and potential impact

This alleged data breach may lead to the exposure of the company's financial processes and operational costs. The exposure of such sensitive financial data could compromise trade secrets and potentially place the company at a competitive disadvantage within the maritime sector. Furthermore, the exposure of financial records could create secondary risks for the company's supply chain partners and employees, as their own data or financial connections might be implicated.

From a regulatory perspective, the company could face legal repercussions under South Korea's Personal Information Protection Act (PIPA). Such frameworks are designed to ensure that organizations maintain strict controls over sensitive data and are held accountable when breaches occur. The potential for legal action underscores the importance of robust data governance and compliance in the transportation and maritime sectors.

In general, organizations operating in the transportation and maritime sectors can take several defensive steps to mitigate the risks associated with ransomware and data exfiltration. Implementing a zero-trust architecture, ensuring rigorous multi-factor authentication (MFA) across all access points, and maintaining offline, immutable backups are standard industry practices. Additionally, continuous monitoring of network traffic and implementing strict data loss prevention (DLP) protocols can help detect and prevent the unauthorized movement of sensitive files. Given the double-extortion tactics used by groups like N0n, organizations must focus not only on system availability but also on the confidentiality and integrity of their data assets.