Ransomware group N0n claims attack on Amagi Media Labs
The criminal group posted what it describes as network configuration files from a US broadcast facility. Amagi has not confirmed any incident, and the claim remains unverified.
Key points
- Ransomware.live first observed N0n's listing of Amagi Media Labs on 18 October 2026.
- The group's post claims to hold network and device configuration files from a US broadcast facility.
- N0n has listed victims across 11 sectors, with Transportation the most frequently targeted.
- Amagi Media Labs has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
- Listings on criminal leak sites are sometimes exaggerated and sometimes false.
A criminal ransomware group called N0n has listed Amagi Media Labs on its dark-web leak site, the pages ransomware gangs use to pressure victims into paying by threatening to publish stolen data. The listing appeared on 18 October 2026, first observed by Ransomware.live.
According to the group's post, the allegedly stolen material involves network and device configuration files from a US broadcast facility. That description is written by the attackers to intimidate. It cannot be taken at face value.
Amagi Media Labs provides playout and streaming technology to television broadcasters and media companies. The firm has not publicly confirmed any breach.
How active is N0n, and why does it matter?
N0n is not a minor nuisance. We first reported on the group on 1 October 2026, and this is our third story on N0n in three months, a pace that reflects how busy the group has been.
Threat Vectr's leak-site tracking spans 11 sectors. Transportation companies appear most often. Technology firms, the category Amagi falls into, also feature. These are aggregate counts of unverified criminal claims, not confirmed incidents.
A group claiming victims at this rate is either running a genuine high-volume operation or inflating its numbers to build a reputation. Both happen. N0n wants to be noticed.
Should you worry if you work with Amagi?
There are sensible precautions worth taking even while the claim is unconfirmed.
Watch for phishing emails: fake messages designed to trick you into clicking a malicious link or surrendering a login. Criminals exploit breach news to send convincing-looking warnings that are actually traps.
Don't reuse passwords. If your Amagi account credentials match a password you use elsewhere, change those other accounts now.
Be sceptical of any call or email offering "breach compensation" or asking you to verify your identity because of this incident. That's a known follow-on scam.
Monitor your accounts for anything unusual. No evidence has emerged that personal customer data was involved in this claim, but caution costs little while the facts are still unclear.
