Arthritis Center of Riverside Ransomware Claim by N0n (Oct 2026)

Claim Summary

The ransomware group tracked as N0n has allegedly listed Arthritis Center of Riverside, a rheumatology medical practice in Riverside, California, on its dark web leak site. According to the threat actor, the listing was posted on or around October 24, 2026. The group claims the victim did not pay a ransom demand and that the purported data has been “exposed.”

This is an unverified claim. Yazoul Security has not independently confirmed that any breach occurred, that the listed organization is the entity described, or that the data referenced actually exists. The claim should be treated as an allegation by a criminal actor until corroborated by the organization or by independent forensic review.

Threat Actor Profile

N0n is a low-profile ransomware operation with no established public research footprint. At the time of writing, there is no reliable open-source documentation of the group’s tooling, initial access techniques, or operational history. Its total known victim count is unknown, and the absence of prior reporting makes any credibility assessment difficult.

Because no known tools or tactics have been publicly attributed to N0n, defenders should not assume a specific intrusion pattern. The group may be a rebrand, a splinter of a better-documented operation, or an opportunistic actor using commodity tooling. Treat the name as a label rather than a confirmed capability profile. Organizations should apply general ransomware detection guidance - monitoring for unusual data staging, mass file access, and anomalous outbound transfers - rather than signatures tied to this group specifically. No YARA rules or detection content specific to N0n are currently available in public sources.

Alleged Data Exposure

According to the threat actor, the purported dataset includes:

• Scanned laboratory requisitions containing named patients, dates of birth, home addresses, and Medicare subscriber details, allegedly dated April through October 2026
• Accounts receivable aging records with patient names, account numbers, insurers, and balances
• Patient billing files and records correspondence

The group claims no ransom was paid and that the data is “exposed.” No data volume or record count was provided in the listing. Yazoul Security has not reviewed any samples and will not link to or reproduce leaked material. The specificity of the described categories is notable but is not proof of authenticity - ransomware operators frequently describe plausible-sounding data to increase pressure on victims.

Potential Impact

If the claim is accurate, the alleged exposure would involve protected health information and financial billing data for patients of a specialty medical practice. That combination - identity details, Medicare information, and billing records - is attractive to fraud and medical identity theft actors. Potential consequences for the organization could include HIPAA regulatory scrutiny, breach notification obligations, patient litigation, and reputational harm.

However, these are hypothetical impacts contingent on verification. Healthcare is a frequently targeted sector, and the mere appearance of a listing does not confirm a successful intrusion.

What to Watch For

• Official statement from Arthritis Center of Riverside or its counsel
• Notification filings with state attorneys general or HHS Office for Civil Rights
• Independent forensic confirmation of any intrusion
• Whether N0n publishes additional “proof” samples, and whether those samples are consistent with the described data
• Reuse of the N0n name across additional victims, which would help establish a track record

Disclaimer

This report is based solely on an unverified claim published on a ransomware group’s leak site. Nothing herein is confirmed. Yazoul Security has not independently verified the breach, the data, the record counts, or the identities involved. Ransomware groups routinely exaggerate or fabricate claims to pressure victims. Readers should rely on official statements from the affected organization and on independent forensic assessment. For related monitoring, see our intel and advisory sections.