LEO Pharma Ransomware Claim by N0n (Nov 2026)

Claim Summary

On November 5, 2026, a ransomware group calling itself N0n allegedly listed LEO Pharma A/S, a Danish pharmaceutical company specializing in dermatology and thrombosis therapies, on its dark web leak site. According to the threat actor, the victim was initially posted anonymously as “Company #136” before being named. The group claims the data was not paid for and is now “exposed.”

The claim asserts an extraordinarily large data set, including what N0n describes as a “patient companion analytics corpus” of more than 315 million patient records and 441,129 rows of transaction-level patient support program records. These figures, if accurate, would represent a significant healthcare data event. However, no independent source has corroborated any element of this claim, and the numbers should be treated with substantial skepticism.

Threat Actor Profile

N0n is a relatively obscure ransomware operation with no publicly documented track record that Yazoul Security can currently verify. The group’s total known victim count is unknown, and there is no public research available describing its tooling, tactics, techniques, or procedures (TTPs). Its known tools are likewise undocumented at the time of writing.

The use of an anonymous “Company #136” placeholder before naming a victim is a tactic some emerging groups use to build leak site credibility and pressure negotiations. The absence of a verifiable history means analysts should assign low initial confidence to the group’s claims. No YARA rules or detection guidance specific to N0n are publicly available; defenders should rely on generic ransomware detection hygiene and monitor for follow-on publications. Organizations seeking to track emerging actors can review our intel library for updates as research becomes available.

Alleged Data Exposure

According to the threat actor, the purported data includes:

• A patient analytics corpus of 315,150,416 records, described as one row per patient, containing age, gender, three-digit ZIP, prescription counts by channel, payer and plan detail, prescriber links, and more than 100 diagnosis and prescription condition indicators per patient.
• 441,129 rows of transaction-level patient support program records with ICD codes, payer and plan names, and pharmacy and prescriber identifiers.

These descriptions are unverified. The claimed volume is unusually large relative to a single pharmaceutical company’s direct patient base, which raises questions about aggregation, duplication, or exaggeration. Ransomware groups routinely inflate data volumes to increase pressure on victims. No samples, proof files, or download references are reproduced here, and none should be sought.

Potential Impact

If the claim were substantiated, the alleged data could implicate sensitive health information and identifiers subject to GDPR and other privacy regimes. Danish and EU regulators, as well as affected partners, would likely scrutinize any confirmed exposure. Potential consequences could include regulatory inquiry, reputational harm, and notification obligations. At this stage, all of this remains speculative and contingent on verification.

What to Watch For

• Official statements from LEO Pharma A/S or Danish data protection authorities.
• Any independent confirmation of leaked data, including breach notification services.
• Follow-on posts by N0n that include verifiable proof, which the group has not yet provided.
• Reuse of the “Company #136” naming pattern indicating a broader campaign.

Disclaimer

This report concerns an unverified claim published on a ransomware group’s leak site. Nothing herein is confirmed. Yazoul Security has not independently verified the breach, the data volume, the data contents, or the group’s identity. The claim may be exaggerated, inaccurate, or fabricated. Readers should treat all details as allegations attributed to the threat actor and await official confirmation.