VULNpocalypse
LowBreach / campaignMonitoring

n0n ransomware group claims Saudi fashion retailer listed as Company #127

The n0n ransomware group claims an unnamed Saudi fashion retailer, Company #127, on its leak site. It is unconfirmed, so watch for a victim statement.

Published
Exploitation
No, the only evidence is a leak-site listing reported by the RansomLook tracker. No entry point or exploitation is confirmed.

What happened

According to the ransomware tracker RansomLook, the n0n ransomware group added an entry titled “Company #127” to its leak site on 2026-11-03. RansomLook’s listing describes the claimed victim only as being in “fashion and lifestyle retail” in Saudi Arabia. The group did not name the company in this entry.

RansomLook’s page for the group also shows a later entry on 2026-11-06 that names a company with the same sector and country description (RansomLook). The sources do not confirm whether that later entry refers to the same organisation as Company #127.

These points are not confirmed:

  • The victim’s identity has not been confirmed.
  • No company has confirmed an incident.
  • There is no independent verification of the claim.
  • The entry point is unknown.
  • Whether data was taken or systems were encrypted is unknown.
  • Any data volume is unknown.

A leak-site listing is a claim by the group, not proof of a breach.

Am I affected?

Not confirmed. The listing does not name the company or describe any data. If you are a customer, partner or employee of a fashion and lifestyle retailer in Saudi Arabia, you cannot tell from this source alone whether your data is involved.

What to do now

  1. Wait for an official notice from the company concerned before you assume your data is exposed.
  2. Treat unsolicited messages that mention this claim with caution, and verify them through the company’s own channels.
  3. Check RansomLook’s group page for updates to this entry.

Sources