Track 23 Ransomware Leak Claims: N0N Group Targets US Healthcare, Tech in 24-Hour Surge

Our data desk analysis of public records shows that twenty-three ransomware leak-site claims were published within a single twenty-four-hour window. The N0N group was the most active actor during this period, accounting for fourteen of those statements. These figures come from the ransomware.live tracker, which our team monitored to count the total volume of criminal announcements made by various groups.

In plain English

These claims are unverified statements made by criminal groups asserting they have stolen data from specific organizations. Our analysis deliberately does not report the names of the alleged victims to avoid amplifying the attackers' publicity efforts. The N0N group leads the activity, followed by qilin with three claims, rhysida with two, and several other groups including emperador, BrainCipher, dragonforce, and incransom with one claim each.

The background

Geographic distribution of these claims shows the United States as the primary target, with ten of the twenty-three statements directed at US-based entities. Canada followed with two claims. Other countries mentioned in the tracker data include Australia, Morocco, Peru, and Colombia, each with one claim. This geographic spread indicates that N0N and other active groups are casting a wide net across different regions during this specific twenty-four-hour tracking window.

What changes now

Sector analysis reveals that healthcare organizations faced four of the claims, making it the most targeted industry in this dataset. Professional services and technology sectors each received two claims. Transportation and government and defense sectors each saw one claim. System administrators should note that these are self-reported assertions by criminals and do not confirm successful breaches or data exfiltration without independent verification from the affected organizations.

What to do and how to stay safe: N0N

• Review your organization's exposure on public ransomware leak sites regularly to identify if your entity has been named in unverified claims.
• Monitor internal security logs for unusual outbound traffic or unauthorized access attempts that could indicate active data theft.
• Ensure that incident response plans include procedures for verifying claims made by attackers on their public platforms.
• Communicate with industry information sharing groups to validate any allegations before taking public action or assuming a breach has occurred.

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which ransomware group was most active in the last 24 hours?

The N0N group was the most active, filing 14 unverified leak-site claims in the 24-hour period analyzed by our data desk.

How many countries were targeted in this 24-hour window?

Six countries were represented in the claims, with the US facing 10, Canada 2, and Australia, Morocco, Peru, and Colombia each facing 1.

Are the victim names in the source material public?

No, the source material explicitly states that victim names are deliberately not reported to avoid amplifying the attackers' efforts.