n0n ransomware group claims attack on unnamed US insurance brokerage
The n0n ransomware group lists an unnamed US insurance brokerage on its leak site, an unverified claim, so watch for an official notice from your broker.
- Published
- Ecosystem
- Enterprise software
- Exploitation
- No, only an unverified leak-site listing tracked by RansomLook, with no confirmation from the victim
What happened
The n0n ransomware group lists a victim it calls “Company #132” on its leak site, according to the claim tracker RansomLook. RansomLook records the entry on 2026-11-04 and describes the victim as an insurance brokerage in the United States. The group does not name the company.
The following details are not confirmed:
- The victim has not confirmed any incident. No source here reports a statement from them.
- No independent outlet has verified the claim. The only sources are a claim tracker and its headline.
- The company’s identity is not confirmed.
- How the attackers got in, whether any data was taken, how much, and whether systems were encrypted are all not confirmed.
A listing on a leak site is the group’s own claim, not proof that a breach happened.
Am I affected?
The victim’s identity is not confirmed, so there is no way to tell from these sources who might be affected. The only details given are “insurance brokerage” and “United States”, per RansomLook. No data types, record counts or affected customers are stated.
What to do now
- Do not assume your broker is the victim based on this listing alone.
- If your insurance broker sends a breach notification, follow the steps it gives.
- Organisations that track third-party risk can monitor the RansomLook n0n group page for updates, such as the victim being named.