Ransomware Group N0n Claims Attack on Heritage Senior Living
A dark-web listing posted on 21 October 2026 names the US healthcare provider. The claim is unverified, and Heritage Senior Living has not publicly confirmed any incident.
Key points
- Ransomware group N0n listed Heritage Senior Living on its dark-web leak site on 21 October 2026, claiming to have stolen internal network and remote-access documents.
- N0n's most frequently targeted sector in Threat Vectr's data is Transportation, though healthcare organisations have also appeared in its claimed victim lists.
- Heritage Senior Living has not publicly confirmed any incident, and the claim could not be independently verified at the time of publication.
- Leak-site listings are written by the attackers themselves to pressure targets into paying and are sometimes exaggerated or false.
A ransomware group called N0n has claimed to have broken into Heritage Senior Living, a US healthcare support provider, threatening to release stolen documents unless it receives payment. The listing appeared on 21 October 2026, first observed by Ransomware.live, the monitoring service that tracks criminal activity across the dark web.
Ransomware is malicious software criminals use to lock an organisation's systems and demand payment to restore access. Most groups now also steal files first, so they can threaten to publish them if payment doesn't arrive.
What does the group claim to have taken?
The group's post describes internal network documents: security configuration records, network layout maps, and remote-access account details. These are the kinds of records that reveal how an organisation's systems are arranged and how staff connect from outside the office. The description comes entirely from the attackers, written to make the theft sound serious enough to compel a payment. No independent verification exists.
How active is N0n right now?
Very. We've covered N0n five times since 1 October 2026, including a listing targeting a New York telehealth firm on 11 October and, two days before this claim, an alleged attack on SMIC US Company. Healthcare has featured repeatedly: our 1 October story covered a claimed attack on a Houston endocrinology practice.
Those stories reflect unverified criminal claims across 12 sectors, not confirmed incidents. The pace suggests N0n is either running a genuine high-volume campaign or inflating listings to build a reputation that pressures future targets into paying quickly. Both are common tactics.
| Metric | Figure |
|---|---|
| Sectors targeted (N0n, per Threat Vectr data) | 12 |
| Threat Vectr stories tagged N0n | 5 |
| Tracking start date | 1 October 2026 |
| Heritage listing date | 21 October 2026 |
Should you worry?
The incident is unconfirmed. Practical caution costs nothing while waiting for clarity.
Watch for phishing: suspicious emails or texts using Heritage Senior Living's name to trick you into clicking a link or handing over personal details. Criminals often exploit leak-site publicity to run follow-on scams targeting the same people.
Be sceptical of unexpected calls offering breach compensation or identity-protection services tied to this news. That's a known scam pattern. If you reuse a password from a Heritage portal on other accounts, change it on those accounts now.
If Heritage Senior Living issues a formal notification, that's the authoritative source. The US Federal Trade Commission provides guidance for people who believe their data has been exposed, covering consumer data protection for US healthcare support services outside the direct scope of HIPAA, the Health Insurance Portability and Accountability Act.
What matters most here is the target. N0n has been quick to list healthcare organisations, and the documents it claims to hold, network layouts and remote-access credentials, are exactly what an attacker would need to move deeper inside a system. Whether the claim holds up or not, any organisation in this sector holding that kind of documentation should be treating this as a prompt to audit who can see it.
