VULNpocalypse
LowBreach / campaignMonitoring

n0n ransomware group claims Company #126, an Italian pharmaceutical firm

RansomLook says the n0n ransomware group claims Company #126, an Italian pharma firm; it is unconfirmed, so wait for an official notice before acting.

Published
Exploitation
No, there is no confirmed compromise, only a leak-site listing recorded by RansomLook

What happened

According to the ransomware tracker RansomLook, the n0n ransomware group listed an entry called “Company #126” on its leak site on 2026-11-03. RansomLook records the group’s description of the organization as “pharmaceutical (biotechnology and specialty)” in “Italy (United States data)”.

The listing is the group’s claim. It is not proof of an attack. Based on the sources available:

  • The organization is not named in this entry, and it has not confirmed any incident.
  • No independent outlet has verified the claim.
  • The entry point, the data involved, the data volume and whether systems were encrypted are all not confirmed.

RansomLook also shows a later n0n entry, dated 2026-11-06, that names a company and uses the same sector and country description. The tracker shows the group often posts an anonymous “Company #” entry first and a named entry a few days later. RansomLook does not say whether this later entry refers to the same organization, so that link is not confirmed.

Am I affected?

Not confirmed. The sources do not say which data, systems, customers or partners the claim involves. The only details are the sector and the country. The phrase “United States data” in the group’s description is not explained.

No software vulnerability, CVE or affected product is mentioned. There is nothing to patch on the basis of this report.

What to do now

  1. If you work with an Italian biotechnology or specialty pharmaceutical company, watch for an official statement or breach notification from that company.
  2. Do not download, open or share any files the group may publish. Their contents and origin are not verified.
  3. Do not treat the leak-site listing as a confirmed breach in internal or customer communications until the organization or an official source confirms it.
  4. Check this advisory again for updates. It will change only if the organization, an authority or an independent outlet publishes new information.

Sources