n0n and ransomware rise in Latin America

n0n published 54 records between Oct. 11 and 13, including 38 organizations in the maritime and logistics supply chain across 18 countries and territories, according to CISOCLUB. At the same time, SCILabs from Scitum and FortiRecon reports show ransomware remaining concentrated in Latin America, with Mexico, Brazil, Colombia and Argentina among the most affected countries in each measurement.

What did n0n publish about the maritime sector?

n0n circulated records that, according to CISOCLUB, covered 38 organizations in the maritime and logistics supply chain across 18 countries and territories. The post attributed four organizations in Brazil to that campaign, but it did not provide public confirmation of compromise from the entities involved.

Risky Business described the case as a suspected supply-chain intrusion from a maritime IT services provider into more than 40 port authorities, shipping companies and maritime organizations. The outlet said the link to the provider remained suspected, not confirmed by the victims.

Waterways Journal reported that the demands attributed to n0n were in the millions of dollars and that the targeted sectors included shipping companies, port and terminal operators, logistics firms and other maritime businesses. It also included Cydome recommendations to review third-party access, supplier exposure and shared credentials through support channels.

Cyware summarized the case as a supply-chain incident tied to n0n that may have affected more than 40 shipping and maritime companies, while distinguishing it from a separately confirmed intrusion at each organization. Risky Business also said the payment deadline tied to the maritime post expired on Oct. 19 and that the organizations were listed on Oct. 12, without independently confirming whether the data was actually exfiltrated or published later.

What do the regional reports show about ransomware?

Available data place Latin America among the regions with the highest number of confirmed ransomware victims, although the cutoffs and methods differ. A post summarizing FortiRecon data reported 141 confirmed victims in Brazil, 69 in Mexico, 50 in Argentina and 41 in Colombia during 2025.

Separately, a post attributing its figures to SCILabs from Scitum reported at least 290 confirmed cases in Latin America during the first half of 2026, with Brazil, Mexico and Colombia showing the highest concentration. That same source identified services, manufacturing and technology as the most affected sectors.

Imagen Radio, citing a report attributed to SCILabs from Scitum, recorded 79 ransomware attacks in Latin America during August 2026 and placed Mexico at the top in reported incidents. It also identified financial services, retail, government, education, healthcare, manufacturing and telecommunications as affected sectors.

What sectors appear in the reports?

The sectors named by the different sources overlap in part, although with different focuses. In the SCILabs material and in Imagen Radio's coverage, the sectors mentioned include services, manufacturing, technology, financial services, retail, government, education, healthcare and telecommunications.

In the maritime case, the sources point to shipping companies, port and terminal operators, logistics firms and other organizations tied to the maritime supply chain. The shared extortion model does not allow those records to be mixed with confirmed victim data in Latin America, since they come from separate reports with different scopes.