n0n ransomware group claims Company #128, a US consumer identity data firm

What happened

According to the claim tracker RansomLook, the n0n ransomware group added an entry titled “Company #128” to its leak site on 2026-11-04. RansomLook lists only the sector and country for the entry: “consumer identity data and analytics” in the United States. The listing does not name the organisation.

Here is what is not confirmed:

• The identity of the victim.
• Whether any intrusion, data theft or encryption took place.
• The entry point.
• The type or volume of any data.
• Any demand or deadline.

No source says that the victim has confirmed an incident, and no independent outlet has reported on this claim. A leak-site listing is the group’s own claim, not proof.

RansomLook’s page for the group shows many other anonymised “Company #” entries. Some of these were later followed by entries naming organisations in matching sectors. No named entry in the source matches the “consumer identity data and analytics” description, and this advisory does not try to identify the company.

Am I affected?

Not confirmed. The source does not name the victim, so there is no way to tell from it which organisation, customers or individuals might be involved.

What to do now

1. Watch for a disclosure from your consumer identity data or analytics providers. Rely on their official statements, not the leak-site listing.
2. Do not visit the leak site or download any data posted there.
3. Check this advisory again for updates if the victim is named or confirms an incident.

Sources

• RansomLook: Company #128: claimed by the n0n ransomware group on its leak site