Delta Dental of Missouri Claimed by N0n - Nov 2026

Claim Summary

The N0n ransomware group has allegedly posted Delta Dental of Missouri, a US dental benefits insurer, to its dark web leak site. According to the threat actor, the claim was listed on or around November 5, 2026. The group purports to have exfiltrated data and has marked the listing as “[NOT PAID - EXPOSED],” suggesting the victim has not met any demand.

This report is based solely on the unverified leak site post. Yazoul Security has not independently confirmed the intrusion, the data theft, or the accuracy of any figures cited by the actor. The claim should be treated as an allegation until corroborated by the organization or a trusted third party.

Threat Actor Profile

N0n is a relatively low-profile ransomware operation. Public research on the group is scarce. Yazoul Security has no confirmed record of prior victims, and there is no widely published tooling or malware family attribution associated with the name. The group’s known tools and tactics are, at present, undocumented in open sources.

That absence of a track record is itself a credibility signal. Groups with no verifiable history may be new entrants, rebrands of established operations, or opportunistic actors attempting to borrow credibility. Some low-profile listings are also fabricated or recycled to generate pressure and notoriety. Analysts should weigh N0n’s claims with heightened skepticism until the group demonstrates a consistent, verifiable pattern of intrusion and extortion.

No YARA rules or detection signatures specific to N0n are publicly available at this time. Defenders should rely on general ransomware detection guidance rather than actor-specific indicators.

Alleged Data Exposure

According to the threat actor, the purported dataset includes:

• A customer relationship database described as containing 48,528 distinct email addresses and 17,913 telephone number lines
• Member and subscriber service records with full names, Social Security numbers, dates of birth, home addresses, and dental treatment details
• Employer group client records with contacts, addresses, and phone numbers, plus insurance broker channel information

The group did not disclose an overall data volume. These figures and data categories are unverified and may be exaggerated. Ransomware operators frequently inflate the scope and sensitivity of stolen data to increase pressure on victims. Yazoul Security has not reviewed any samples and will not link to or reproduce leaked material.

Potential Impact

If the claim is accurate, the alleged exposure of Social Security numbers, dates of birth, and treatment details would represent a serious privacy and identity theft risk for affected members. Dental treatment information can be sensitive and, in some contexts, revealing. Employer and broker contact records could also enable targeted business email compromise or phishing.

Regulatory exposure is a further consideration. Healthcare insurers in the US operate under HIPAA and state breach notification laws. Any confirmed breach of protected health information would likely trigger notification obligations and potential regulatory scrutiny. These are potential consequences only and depend entirely on whether the claim is substantiated.

What to Watch For

• Official statements from Delta Dental of Missouri confirming or denying the incident
• Breach notifications filed with state attorneys general or regulators
• Notification letters to members and employer clients
• Follow-up leak site posts, including data samples or countdown timers
• Phishing campaigns referencing dental benefits or insurance enrollment

Organizations in the healthcare insurance sector should review third-party access, monitor for credential abuse, and reinforce phishing awareness among staff and members.

Disclaimer

This report covers an unverified claim published by a ransomware group on a dark web leak site. Nothing here has been independently verified by Yazoul Security. The organization has not confirmed the intrusion, the data theft, or any of the figures cited. Ransomware groups routinely exaggerate claims to pressure victims, and some listings are entirely fabricated. Treat all details as allegations until confirmed by authoritative sources.