Ransomware Group N0n Claims Attack on Houston Thyroid and Endocrine Specialists
A criminal group has listed a Houston endocrinology practice on its dark-web pressure site, claiming to hold patient records. The practice has not publicly confirmed any incident.
Key points
- Ransomware group N0n's post, observed by monitoring service Ransomware.live on September 30, 2026, lists Houston Thyroid & Endocrine Specialists by name and claims to hold patient health records.
- The listing sets a deadline of October 4, 2026 at 12:00 UTC, a pressure tactic criminals use to force payment before threatening to publish data.
- Houston Thyroid & Endocrine Specialists has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
- Ransomware listings are sometimes exaggerated or entirely false; criminal groups write them to frighten victims into paying.
A ransomware group called N0n has claimed responsibility for an attack on Houston Thyroid & Endocrine Specialists, a medical practice in Texas. Ransomware is malicious software that criminals use to lock or steal a company's files, then demand payment to restore access or keep the data private. N0n's claim appeared on a dark-web leak site, a hidden website criminals run to publicly name targets who haven't yet paid, and was first observed by monitoring service Ransomware.live on September 30, 2026.
The group's post claims the stolen material includes patient health records. The practice has made no public statement. That claim alone warrants no assumption that it's accurate.
How active is N0n?
Very active, and apparently very new. N0n is a group Threat Vectr hasn't encountered before in its twelve leak-site stories published in the past 90 days. Groups posting many claims in a short window are either genuinely prolific or padding their numbers with exaggerated listings to build a fearsome reputation fast. Both happen.
What does the listing actually claim?
The group's post describes medical records belonging to patients of the Houston practice. Those are broad categories any attacker would mention to maximize pressure. Treat the specifics skeptically: the post is written by criminals whose entire goal is to frighten the victim into paying before a stated deadline.
N0n set that deadline for October 4, 2026 at 12:00 UTC. Whether the practice pays or says nothing, the deadline is a coercion mechanism, not a firm date after which anything definitive happens.
Should you worry if you're a patient?
No immediate action is required based solely on this unverified claim. A few sensible steps cost nothing, though.
Watch your inbox for phishing emails, fake messages designed to trick you into handing over personal details, especially any mentioning a "data breach notice" or offering "compensation" for a supposed leak. Criminals run those scams alongside leak-site claims to exploit the news cycle.
Don't reuse the same password across different websites. If login details from any source appear in a real breach, attackers try them everywhere. A free password manager makes unique passwords practical.
Be skeptical of phone calls claiming to be from the practice or a government agency about your health records. Hang up and call the practice back on a number you find yourself.
Should the practice confirm an incident, US federal law under the Health Insurance Portability and Accountability Act (HIPAA), which governs how medical providers protect patient data, requires them to notify affected patients directly. That formal notice is the reliable signal to act. We've tracked ten HIPAA-related incidents since July 10, and the notification process, while mandatory, rarely moves fast.
One thing worth watching: N0n's speed matters more than its victim count. A group claiming this many targets this quickly, in healthcare no less, is either operationally serious or manufacturing pressure through volume. The deadline passes October 4. If the practice stays silent and N0n publishes, that's when the picture sharpens.
