Kingwood Endoscopy Ransomware Claim by N0n (Oct 2026)

Claim Summary

A ransomware group operating under the name “N0n” has allegedly listed Kingwood Endoscopy, a US-based healthcare organization in Texas, on its dark web leak site. According to the threat actor, the attack purportedly occurred on October 19, 2026. The group claims to have exfiltrated sensitive operational data and asserts that the victim has not paid the demanded ransom, resulting in the data being marked as “exposed.”

This claim remains entirely unverified. No independent confirmation from Kingwood Endoscopy, law enforcement, or third-party security researchers has been observed at the time of writing. The details presented below reflect only what the threat actor has publicly alleged.

Threat Actor Profile

The group self-identifies as N0n. At present, there is no publicly available research, historical victim list, or documented tooling associated with this actor. Yazoul Security has not observed prior campaigns attributed to N0n, and the group’s total known victim count is currently unknown.

Because no established track record exists, the actor’s credibility cannot be meaningfully assessed. It is possible that N0n is a new or rebranded operation, a low-volume actor, or an entity making unsubstantiated claims to build notoriety. No known tools or tactics have been documented. Organizations should treat the claim with heightened skepticism while remaining alert to the possibility of a genuine intrusion. Absent YARA rules or detection signatures specific to this group, defenders should rely on general ransomware detection guidance, including monitoring for unusual credential access, lateral movement, and remote-access tool abuse.

Alleged Data Exposure

According to the threat actor, the purported data set includes:

• The complete network configuration of an outpatient endoscopy surgery center
• Every account, password, and access path
• Proof of “total control” of the center’s records, camera, and remote-access systems
• The center’s full device and systems map

The group did not disclose a data volume. These claims are grandiose and, if accurate, would represent a severe compromise of both IT and physical security systems. However, ransomware operators frequently exaggerate the scope and sensitivity of stolen data to pressure victims into paying. The assertion of “total control” over camera and remote-access systems is particularly difficult to verify and should not be accepted at face value.

Potential Impact

If the claims are substantiated, the exposure of credentials and access paths could pose significant risks to patient privacy, operational continuity, and physical security at the facility. Healthcare organizations are frequent targets due to the sensitivity of patient data and the operational pressure to restore services quickly. However, no evidence of actual data publication, patient impact, or system compromise has been independently confirmed.

What to Watch For

• Official statements from Kingwood Endoscopy regarding any security incident
• Notification from regulators or law enforcement, such as HHS OCR or the FBI
• Any authenticated samples or proof-of-compromise released by the actor
• Emergence of the data on other criminal forums or marketplaces
• Rebranding or increased activity from N0n that may establish a track record

Disclaimer

This report is based solely on an unverified claim published by a ransomware group on its leak site. Yazoul Security has not independently verified the accuracy of any statement, the existence of the alleged data, or the occurrence of the attack. Ransomware actors routinely exaggerate or fabricate claims. Nothing in this report should be construed as confirmation of a breach. Affected parties should conduct their own investigation and consult qualified incident response professionals.