Dompé Farmaceutici Ransomware Claim by N0n (Nov 2026)

Claim Summary

The ransomware group tracked as N0n has allegedly listed Dompé Farmaceutici S.p.A., an Italian pharmaceutical company, on its dark web leak site. According to the threat actor, the listing was posted on or around November 6, 2026, and the group claims to have exfiltrated a substantial data warehouse tied to the company’s United States ophthalmology business.

The group purports that the stolen material includes patient dimension tables, drug, diagnosis and plan dimensions, and full prescription, procedure and diagnosis claim archives. The listing carries a “NOT PAID - EXPOSED” tag, which the actor uses to signal that a victim has not met its demands and that data has purportedly been released.

No data volume has been disclosed. Yazoul Security has not independently verified any element of this claim.

Threat Actor Profile

N0n is a low-profile ransomware operation with no publicly documented track record that Yazoul Security can currently corroborate. The group’s total known victim count is unknown, and there is no public research available describing its tooling, infrastructure, or affiliate structure. Its known tools and tactics are, at present, undocumented.

This absence of a verifiable history is itself a significant analytic caveat. Groups with little or no established footprint may be new entrants, rebrands of existing operations, or opportunistic actors making outsized claims to attract attention. Some low-profile groups also exaggerate the scope and sensitivity of stolen data to increase pressure on victims during negotiation.

Because no YARA rules, detection signatures, or technical indicators are publicly associated with N0n at this time, defenders should rely on general ransomware detection guidance - monitoring for unusual data staging, large outbound transfers, and unauthorized access to claims-processing systems - rather than actor-specific signatures. Yazoul Security will update its actor profile at /intel/actor/n0n/ if corroborated tooling or infrastructure emerges.

Alleged Data Exposure

According to the threat actor, the purported dataset centers on a US ophthalmology claims environment. The group claims the archive includes:

• Patient dimension tables
• Drug, diagnosis and plan dimensions
• Full prescription, procedure and diagnosis claim archives

If accurate, such records would represent highly sensitive protected health information (PHI) and could carry regulatory implications under US law, including HIPAA. However, the group has provided no verifiable samples, no volume figures, and no independent proof of access. Claims of this nature are routinely overstated, and the described structure may be inferred or fabricated rather than genuinely exfiltrated.

Yazoul Security does not reproduce, link to, or provide access to any leaked material, samples, or actor infrastructure.

Potential Impact

If the claim is substantiated, potential consequences could include exposure of sensitive patient and claims data, regulatory scrutiny, notification obligations, and reputational harm to the affected business unit. Healthcare claims data is a high-value target for fraud and identity-related abuse.

That said, the impact remains speculative. The actor has not demonstrated possession of the data, and the “EXPOSED” designation is an unverified assertion. Organizations should treat the claim as a prompt for internal verification rather than confirmation of a breach.

What to Watch For

• Official statements from Dompé Farmaceutici or its US affiliates
• Regulatory or breach-notification filings in the US or Italy
• Independent confirmation of exfiltration from forensic or third-party sources
• Any corroborating technical indicators that would allow attribution to N0n
• Follow-on activity or additional victim listings that establish the group’s credibility

Defenders in healthcare and life sciences should review access controls on claims-processing systems, validate data-loss prevention coverage for large outbound transfers, and ensure incident response playbooks address extortion claims of uncertain validity.

Disclaimer

This report is based solely on an unverified claim published by a ransomware group on its leak site. Nothing in this article has been independently verified by Yazoul Security. The organization named has not been confirmed as breached, and the described data exposure is alleged only. Ransomware groups frequently exaggerate or misrepresent their claims to pressure victims. Readers should await official confirmation before drawing conclusions. Yazoul Security provides this analysis for defensive awareness and does not endorse, facilitate, or link to any illicit activity or leaked data.