Asisken Asistencia Médica Ransomware Claim by N0n (Oct 2026)

Claim Summary

The ransomware group tracked as N0n has allegedly listed Asisken Asistencia Médica S.A., a healthcare and health insurance administration organization reportedly based in Guayaquil, Ecuador, on its dark web leak site. According to the threat actor, the attack occurred on 24 October 2026 and the listing carries a “NOT PAID - EXPOSED” status, suggesting the group claims to have already published or intends to publish the data.

The group claims to have exfiltrated a substantial volume of records, including identity and contact details of 139,006 named insurance clients, 383,159 policy beneficiary records, and 402,988 medical and insurance claims containing diagnosis codes and dollar amounts. These figures are unverified and should be treated with skepticism. The country field in the listing (AR) does not align with the Ecuadorian location described in the claim text, which is itself a minor inconsistency worth noting.

Threat Actor Profile

N0n is a relatively obscure ransomware operation with no publicly documented research references available at the time of writing. Its total known victim count is unknown, and no confirmed tooling or tactics have been publicly attributed to the group. This lack of a verifiable track record significantly limits our ability to assess the credibility of this specific claim.

Because no known tools, malware families, or established TTPs are documented for N0n, defenders should not assume a specific intrusion vector. The group may be a rebrand, a low-volume opportunistic actor, or a newly emerged operation borrowing leaked builder code. Organizations should apply general ransomware hygiene rather than relying on group-specific signatures. No YARA rules or detection guidance specific to N0n are currently available from public sources; generic ransomware behavior monitoring (mass file encryption, shadow copy deletion, unusual outbound transfer volumes) remains the practical detection baseline.

Alleged Data Exposure

According to the threat actor, the purportedly exfiltrated data includes:

• Identity and contact records of 139,006 named insurance clients, allegedly including identity document numbers and dates of birth
• 383,159 policy beneficiary records with insured amounts
• 402,988 medical and insurance claims with diagnosis codes and dollar amounts, claimed current through 20 October 2026
• Policy billing information, home and work addresses, and bank account details

If accurate, this would represent a serious exposure of protected health information and financial data. However, none of these volumes, fields, or dates have been independently verified. Ransomware groups routinely inflate record counts and pad listings with fabricated or duplicated samples to increase pressure on victims. The specific claim of data “current through 20 October 2026” is a common tactic to imply deep network access.

Potential Impact

Should the claim prove accurate, affected individuals could face identity theft, medical fraud, and phishing risks given the alleged presence of document numbers, dates of birth, and bank details. The organization could face regulatory scrutiny under Ecuadorian data protection law, reputational harm, and potential litigation. Healthcare insurers are attractive targets because of the density and sensitivity of their records.

What to Watch For

• Official confirmation or denial from Asisken Asistencia Médica S.A.
• Regulatory notifications from Ecuadorian data protection authorities
• Breach notification letters to affected policyholders
• Whether N0n publishes verifiable sample data (do not seek out or access leaked data)
• Any follow-on phishing campaigns referencing the organization

Disclaimer

This report is based solely on an unverified claim posted to a ransomware group’s leak site. Yazoul Security has NOT independently verified the attack, the data exposure, the record counts, or the group’s identity. Nothing in this report should be treated as confirmed fact. The threat actor may be exaggerating, misrepresenting, or fabricating details. Readers should await official statements from the organization and relevant authorities before drawing conclusions.