N0n 2026 activity
Extortion group. 7 reports in 4 countries: 0 confirmed, 7 claimed or disputed. Latest 12 Oct 2026.
Singapore · 
Indonesia · 
Vietnam · 
Saudi Arabia
🎯 What sources say
- Singapore: Listed Apical Group and Ocean Network Express in October 2026. ransomware.live
- Vietnam: Posted data from BeLi Teacher, FSC education centers and the GC789 betting network in September 2026, besides the tracked Nam Dinh Vu Port claim. ransomware.live Vietnam map
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ⚠️ ClaimedOcean Network Express | Singapore | 12 Oct 2026 | Transport | Ransomware | N0n | Claimed. The Singapore-based container line is listed on N0n's leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedApical Group | Singapore | 12 Oct 2026 | Manufacturing | Ransomware | N0n | Claimed. The N0n group listed Apical Group on its leak site on 2026-10-12. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedILCS Pelindo | Indonesia | 12 Oct 2026 | Transport | Ransomware | N0n | Claimed. Pelindo's port logistics IT unit is listed on N0n's leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedNam Dinh Vu Port | Vietnam | 12 Oct 2026 | Transport | Ransomware | N0n | Claimed. The container terminal operator is listed on N0n's leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedNEOM Ports | Saudi Arabia | 12 Oct 2026 | Transport | Ransomware | N0n | Claimed. N0n listed NEOM Ports on its leak site and threatened to publish tariff and invoicing records. NEOM has not commented. | DeXpose · ransomware.live✓ 8 Nov |
| ⚠️ ClaimedBeLi Teacher / FSC education centers | Vietnam | 18 Sep 2026 | Education | Data leak | N0n | Claimed. N0n posted data it said came from the AWS environment of BeLi Teacher and FSC education centers on 18 September 2026. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedGC789 betting network (Boundless TE) | Vietnam | 18 Sep 2026 | Other | Data leak | N0n | Claimed. N0n listed a Vietnamese betting operator it named as the GC789 network on 18 September 2026. | ransomware.live✓ 7 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology