Company #155 Ransomware Claim by N0n (Nov 2026)

Claim Summary

On or around November 9, 2026, the ransomware group tracked as N0n purportedly listed an entity identified only as “Company #155” on its dark web leak site. According to the threat actor, the victim is a French (FR) organization operating in the eyewear and retail sector. The group alleges it exfiltrated data during the intrusion and has tagged the listing as “[PENDING EXPOSURE],” suggesting that a public data release may follow if the victim does not engage.

The claimed data volume is undisclosed, and no sample files, screenshots, or proof-of-compromise artifacts have been observed in the available listing metadata. The organization’s domain was not published in the source data, and the industry field was recorded as “Not Found,” which limits our ability to independently correlate the claim to a specific corporate entity. At this stage, this remains an unverified assertion by the threat actor and nothing more.

Threat Actor Profile

N0n is a low-profile ransomware operation with no publicly documented research references, no confirmed tooling list, and an unknown total victim count. This absence of a track record is itself a significant analytic gap. We cannot assess whether N0n is an established extortion crew, a rebrand of a prior operation, or a newly emerged group attempting to build notoriety through aggressive listing activity.

Because no known tools or tactics have been publicly attributed to N0n, defenders should not assume a specific initial access vector, encryption routine, or exfiltration toolset. Standard ransomware tradecraft - including phishing, exposed remote access services, and exploitation of unpatched edge devices - should all be treated as plausible. No YARA rules or detection signatures specific to N0n are currently available in public sources; organizations should rely on behavioral detections for mass file modification, shadow copy deletion, and unusual outbound data transfer rather than group-specific indicators.

Alleged Data Exposure

The group claims to hold data from a French eyewear and retail business. The listing provides no data volume, no file tree, and no samples. The “[PENDING EXPOSURE]” tag indicates the actor is threatening a future release, a common pressure tactic. We have not reproduced, linked to, or validated any leaked material, and none has been confirmed to exist.

Potential Impact

If the claim is accurate, a retail and eyewear organization could face exposure of customer records, supplier contracts, and internal financial data. French organizations are also subject to GDPR obligations, which may trigger regulatory notification requirements if personal data is confirmed compromised. Operational disruption from encryption, if any occurred, is unknown.

What to Watch For

• Publication of verifiable proof-of-compromise artifacts by the actor
• Follow-on listing updates changing “[PENDING EXPOSURE]” to an active leak
• Any contact from the actor to the victim organization
• Regulatory filings or breach notifications from French authorities

Disclaimer

This report is based solely on an unverified claim posted to a ransomware group’s leak site. Yazoul Security has NOT independently verified the attack, the victim’s identity, the data volume, or the existence of any exfiltrated data. Ransomware groups routinely exaggerate or fabricate claims to pressure victims. Treat all statements here as allegations “according to the threat actor” until confirmed by the organization or authoritative sources.