Our global freight forwarding network keeps our customers freight moving across the world.

Gemini signals full Suez return by Q1 as it launches new Asia-Med service

Maersk and Hapag-Lloyd have revealed a further redesign to the Gemini Cooperation's Asia-Mediterranean network which will see a reorganisation of the regional hub-and-spoke model. Slated for introduction over the course of the second half of November, the move comes as the two carriers eye a full resumption of Suez transits by early next year, according to Hapag-Lloyd chief executive Rolf Habben Jansen. "We have announced a fair number of services that already have returned, and some more are returning in the weeks to come," he said in a press beefing last week. "As we have said all along, if we go back, we will do it step by step and in a managed way. I'm really happy that's what we've done, because we can also manage the load on the hubs and on the ports in Europe and the Mediterranean. "So far, that has not caused too many problems, it's been going well - if there is no change, I would expect that more or less all of our services will be back through Suez, maybe with one or two exceptions, somewhere in the course of Q1 next year," he added. The chief development in the revamped network is that Gemini will launch a new "transhipment hub-only" service between China and the west Mediterranean via the Suez Canal, dubbed AE18 by Maersk and SE5 by Hapag-Lloyd, featuring the following port rotation: Shanghai-Xiamen-Tanjung Pelepas-Algeciras-Tangier-Algeciras-Xiamen. The first vessel on the AE18/SE5 will be the 13,100 teu Maersk Edirne departure from Shanghai on 22 November. The vessel is currently completing her deployment on Maersk's standalone Asia-Mexico AC2 service. Maersk said the new service was designed to complement its other Asia-Europe strings as well as flows from Asia to West Africa and South America with its west Mediterranean hubs taking on more relay transhipment responsibilities. "These changes include the introduction of the new AE18 service, which, together with AE19, will consolidate our existing West Mediterranean hub coverage. "Through our modular network concept, this will also enable product enhancements for our customers, eg shipping from Asia to West Africa and to the East Coast of Latin America," it said in a customer advisory. As a result, Gemini's Asia-North Europe Loop 1 (Maersk AE2/Hapag NE1) will replace its current first European port of call of Tangier with Rotterdam, "providing an alternative and improved service from Ningbo and Shanghai to Rotterdam". The Asia-Mediterranean Loop2 (Maersk AE11/Hapag SE2) will also drop a call at westbound Tangier in favour of Port Said and introduce a pre-Suez call at Salalah. Meanwhile, the recently inaugurated Asia-Mediterranean Loop4 will insert an additional call at Damietta, close to Port Said and where Gemini appears to be developing a twin-hub strategy, as well as replacing Shanghai with Nansha. Further to which, the phased approach of returning Gemini services through Suez has been praised by liner analyst Lars Jensen, speaking at the same press briefing as Mr Habben Jansen. "For me, it has been a very positive surprise so far, that the changeover is happening as slowly as and gradually as it is actually doing," said Mr Jensen. "Before the normalization started, my key hypothesis was that this would happen a lot faster, and I'm positively surprised at the restraint we see from the carriers in terms of not making it a fast transition. "The latest numbers, at least I have, is we are roughly 30%-35% normalised across the market for the Suez routing - slightly more on the backhaul, slightly less on the head haul," he added.

Cyber-crime group hits 38 shipping and port groups with date leak threat

Cyber extortion group 'n0n' has named 38 organisations across the global shipping and ports sector on its dark-web leak site, raising concerns that data may have been stolen. Cybersecurity firm SOCRadar reported yesterday n0n published the listings in a single batch on 12 October, that included container terminals, shipping lines, port IT providers, and logistics businesses across 18 countries. None of the maritime organisations named had publicly confirmed a breach at the time of writing. South Korea accounted for 12 listings, including Busan terminal operators BNCT and Pusan Newport Co. The list included Brazilian port operators Santos Brasil, Portonave, and Superterminais; Singapore-based carrier ONE; China's CULines; Taiwan's TS Lines; Spain's TTI Algeciras; and Morocco's Eurogate Tanger. The batch more than doubled n0n's previously recorded victim count. The group emerged last month, listing 21 organisations across sectors including telecoms, retail, pharmaceuticals, and education. SOCRadar said the pattern of data described in the listings suggested a possible common point of entry, rather than 38 separate network intrusions. According to the researchers, the relatively small, narrowly focused datasets and recurring document types could indicate information had been taken from an application or integration platform used by multiple organisations. Reviewed samples included electronic data interchange (EDI) messages, container manifests, vessel schedules, gate movements, and terminal system configuration records. The claimed volumes ranged from 60mb for South Korean logistics company EUSU, to 2.4gb for Indonesia's ILCS Pelindo. The absence of matching infostealer credential records for many of the listed companies also complicates the theory that each intrusion began with stolen employee credentials, which SOCRadar identifies as a typical n0n access method. But it warned that a shared system could extend the potential exposure beyond the organisations named on the leak site. EDI records and manifests can contain information on cargo movements, bookings, and commercial relationships involving shipping lines and other supply chain partners. The pattern is reminiscent of mass-exploitation campaigns involving file-transfer software vulnerabilities, including the MOVEit Transfer attacks in 2023 and Cleo in 2024. However, SOCRadar said there was no evidence linking n0n to those incidents. The cybercrime group has set a publication deadline of 19 October at 1.27pm UTC for the maritime listings reviewed by SOCRadar. Its leak site uses countdowns and status labels to pressure victims into paying. Settlement demands have ranged from $2.4m to $14m, payable in bitcoin. The amounts did not appear to correspond with the volume of data allegedly stolen: EUSU Logistics faced a $14m demand for 60mb, with ILCS Pelindo at $2.4m for 2.4gb. Some listings also offered victims the option of opening negotiations after paying 10% of the demand. SOCRadar described n0n as a "financially motivated data-theft extortion operation" that generally avoids traditional ransomware deployment, instead threatening to publish stolen information. Its profile nevertheless includes techniques associated with encryption and interference with recovery, meaning disruptive activity cannot be ruled out. The group's claims remain unverified. Of its 21 earlier victims, SOCRadar said 19 remained at the claimed stage, one was listed as negotiating, and one, Chibitek, had experienced a data leak. Therefore, the 19 October deadline could provide the first substantive indication of what information n0n holds, and whether the alleged exposure extends across shared platforms. SOCRadar warned that maritime businesses that exchange EDI with companies named in the attack should plan for the possibility that their operational data could appear in the 19 October release. It advised them to identify the port community systems, EDI hubs, and file-transfer services handling their data; to check with providers for potential breaches, patch exposed systems, and investigate unusual access or bulk downloads. It also recommended rotating integration credentials, checking for compromised employee and supplier credentials, enforcing multi-factor authentication on remote access, and removing internet-exposed RDP services. It also advised firms to prepare communications for customers and regulators in case data is exposed through a third party, and monitor n0n's activity for further leak-site postings.

News in Brief Podcast | Week 41 2026 | Congestion, cyberthreat and capacity constraint

Port congestion is putting pressure on global supply chains, from West Africa and Europe to the Middle East, while escalating conflict is creating fresh challenges for air cargo. In this episode, Drewry's head of Ports and Terminals, Eirik Hooper, joins us to discuss the causes of congestion, whether major investments in African ports will deliver meaningful improvements, and how automation could help terminals boost efficiency. We also examine the growing cyber threat facing shipping and port operators. Plus, Loadstar publisher Alex Lennane joins us to unpack the impact of the US/Iran war on air cargo capacity in Saudi Arabia, the squeeze on airfreight capacity as peak season approaches, and Samsung SDS's move to strengthen its airfreight business through the acquisition of Woojung Air. And what's making headlines on The Loadstar Premium? We take a look at Kuehne+Nagel's growth ambitions, the world's leading freight forwarders and ransomware threats targeting the logistics sector.