ransomware group · unknown · active since 2026-09-18 (earliest leak-site activity tracked by this dashboard; prior activity unknown)
n0n is a data-extortion operation that surfaced on this dashboard's leak-site tracking on 2026-09-18, when nine victim entries were published in a single-day batch spanning the Americas, Europe, and Asia. Claimed victims cut across government, education, financial services, and healthcare, including high-profile names such as AstraZeneca's Türkiye operations, Argentina's Ministry of Education, the United Federation of Teachers, and an entry describing PayPal support operations at BPO provider Transcom WorldWide. No ransomware binary or affiliate program has been widely attributed to n0n in public vendor reporting, and no credible ransom or earnings figure is available. All victim claims are leak-site self-publications and should be treated as unverified until confirmed by the named organizations.
United Federation of Teachers (US labor union) — alleged, leak-site listing, AstraZeneca Türkiye — alleged, leak-site listing, Ministry of Education, Argentina — alleged, leak-site listing, PayPal (support operations via Transcom WorldWide) — alleged, leak-site listing, Transcom WorldWide (global CX/BPO provider) — alleged, leak-site listing, STOKR (Luxembourg digital securities platform) — alleged, leak-site listing, Argentem Creek Partners (US investment firm) — alleged, leak-site listing, GC789 network / Boundless TE (Vietnamese betting operator) — alleged, leak-site listing, Konnatus (Brazilian usucapião legal services) — alleged, leak-site listing
| Victim | Discovered | Details |
|---|---|---|
| Company #3 | · 11h ago | IT managed services · United States |
| Company #2 | · 11h ago | Financial services · Canada |
| Company #1 | · 11h ago | technology · United States |
| Houston Thyroid & Endocrine Specialists | · 5d ago | Healthcare - Endocrinology (US) · Houston, Texas |
| MCAP — MortgageHub commercial lending platform | · 5d ago | Mortgage securitization and servicing (Canada) · Canada |
| Precision Facades Ltd |
No public figure.
| · 6d ago |
| Facade engineering and construction (UK) · United Kingdom |
| Dediserve Ltd | · 7d ago | Cloud infrastructure provider (iomart group) · Dublin, Ireland / FRA1 Frankfurt DC |
| Inter (Venezuela's largest internet provider) | · 9d ago | Telecommunications / ISP · Venezuela |
| Fanatics (global sports commerce platform) | · 9d ago | Sports commerce / e-commerce · United States |
| FinSoft (Kolibri retail back-office software) | · 9d ago | Retail software vendor / IT services · Uzbekistan |
| AFRICA-TECH (IT services / document processing) | · 9d ago | IT services / document services · Mali |
| United Federation of Teachers | · 17d ago | Education / Labor Union · US — New York What will be published if no settlement is reached The union’s complete legal case archive — approx. 181,420 documents: grievance and arbitration files, disciplinary appeal decisions and personnel case files, each named for a member Contract documents: CBAs, MOUs, MOAs and side letters Nurse-federation and health-benefit-fund case materials Teacher evaluation and class-size complaint files Staff search and case-view audit logs Publication proceeds in batches after the deadline. The victim can verify everything and settle in their private negotiation room. |
| Vietnamese betting operator (GC789 network / Boundless TE) | · 17d ago | Online gambling / agent platform · Vietnam / Switzerland What will be published if no settlement is reached The complete bettor database: 2,021,011 registered bettors with names, +84 phone numbers, email addresses, deposit and withdrawal amounts The full agent network: 39,998 agent accounts, hierarchy, balances, credit lines and commission ladders 85 million login records with IP addresses and device identifiers Daily trading and P&L data per provider The fraud stack: 33,000+ blacklisted emails and phones, arbitrage and odds-mover reports, multi-account detection rules Publication proceeds in batches after the deadline. |
| BeLi Teacher / FSC education centers (AWS) | · 17d ago | Education / edtech · Vietnam What will be published if no settlement is reached The complete CRM lead database: 152,044 contact records — names, emails, +84 phone numbers, cities, study interests, engagement history The CRM file archive (tasks, forums, comments, customer files) migrated from GetFly CRM Publication proceeds in batches after the deadline. |
| Konnatus (usucapião legal services) | · 17d ago | Legal services / real estate · Brazil What will be published if no settlement is reached The application database: chart of accounts, income/outflow structures, account types User accounts with password hashes Publication proceeds after the deadline. |
| STOKR (digital securities platform) | · 17d ago | Digital securities / investment platform · Luxembourg - EU What will be published if no settlement is reached KYC investor register: full names, emails, countries, nationalities, wallet addresses and tax IDs where present Identity-to-crypto-wallet mapping of KYC-accepted investors (FR, DE, CH, BE, NL, UK and others) Internal platform admin directory with staff accounts and roles The investor data will also be delivered to the tax authorities of the investors' countries. |
| AstraZeneca Türkiye | · 17d ago | Pharmaceutical manufacturing (GxP) · Türkiye What will be published if no settlement is reached Complete internal network-security configuration of all 3 sites (940 MB): every rule, device definition, remote-access mappings 1.35M connection records: M365/Intune, SAP Concur, UniFi camera estate, internal applications All sites are enforcing a total network blackout until settlement. |
| Argentem Creek Partners (investment firm) | · 17d ago | Investment management / private credit · United States What will be published if no settlement is reached Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integrations) Tax-season document flows of the firm and its investor document delivery platform Corporate connectivity remains severed until settlement. |
| Ministry of Education — Argentina | · 17d ago | Government / education · Argentina What will be published if no settlement is reached Complete network-security configuration of the ministry network 1.08M connection records: national library (BNM), school-book selection platform, scholarship systems (becasprogresar), titulosvalidez, certificadosinfd, sitrared Evidence of the Monero cryptocurrency miner operating inside the ministry network The ministry network is under a total blackout until settlement. |
| PayPal support operations (Transcom WorldWide) | · 17d ago | Outsourced customer support / financial services · Netherlands / Tunisia What will be published if no settlement is reached 86.7M connection records: daily support-agent sessions into PayPal corporate Citrix/AAA systems Complete infrastructure map: internal AD, PKI, Netskope/Zscaler tenants, all 8 sites All 8 sites are enforcing a network blackout until settlement. |