VULNpocalypse
LowBreach / campaignMonitoring

n0n ransomware group claims Danish pharmaceutical firm listed as Company #136

The n0n ransomware group claims an unnamed Danish pharmaceutical firm as Company #136. It is unverified, so partners should await an official notice.

Published
Exploitation
No, not confirmed. The only evidence is a leak-site listing reported by a claim tracker.

What happened

According to the claim tracker RansomLook, the n0n ransomware group added an entry titled “Company #136” to its leak site on 2026-11-05. The group describes the organisation as “pharmaceutical (dermatology and thrombosis)” based in Denmark.

The listing does not name the company. RansomLook’s page shows only the date, the placeholder title and the short description.

These details are not confirmed:

  • The victim’s identity.
  • Whether any intrusion, data theft or encryption took place.
  • The entry point, the data involved and any volume of data.

No victim statement and no independent verification appear in the sources. A leak-site listing is the group’s own claim, not proof of an attack.

Am I affected?

Not confirmed. The sources do not name the organisation, so they do not say which partners, customers or patients could be affected.

The only identifying details, per RansomLook, are the sector (dermatology and thrombosis pharmaceuticals) and the country (Denmark).

What to do now

  1. Treat the listing as an unverified claim. Wait for a statement from the company or an official authority before taking incident-specific action.
  2. If you think you have a relationship with a company matching this description, ask it through your usual contact for its own statement.
  3. Do not download or share any files the group may post. Their origin and contents are not confirmed.
  4. Check RansomLook or official channels for updates, such as the entry being renamed or the company confirming or denying the claim.

Sources