Ransomware Group N0n Claims Attack on Missouri Dental Lab BladeTech Inc

Key points

• Threat Vectr's tracking has recorded 105 claimed victims attributed to N0n since September 2026, all 105 appearing in the past 30 days, across 10 sectors.
• N0n listed BladeTech Inc, a Missouri-based dental laboratory that designs and mills dental crowns and bridges using computer-controlled machinery, on its dark-web leak site on 16 October 2026.
• The group's post claims the stolen material includes patient case files, tooth specifications and production records, along with a 4.4 GB archive, though that figure comes from the attackers and has not been verified.
• BladeTech Inc has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
• Transportation companies have been N0n's most frequent targets according to Threat Vectr tracking, but the group now appears to be hitting healthcare-adjacent manufacturing.

A ransomware group, meaning a criminal organisation that breaks into computer systems, steals data and threatens to publish it unless a ransom is paid, has claimed it targeted a small dental manufacturing company in Missouri. The group calls itself N0n, and the listing was first observed on 16 October 2026 by the monitoring service Ransomware.live.

BladeTech Inc operates as a dental laboratory, producing physical dental restorations like crowns and bridges. CAD/CAM software (computer-aided design and computer-aided manufacturing, the tools that translate a dentist's scan into a finished tooth) drives the design work. The group's post claims the stolen files relate to production jobs from September and October 2026.

What did the criminals claim to have taken?

N0n claims patient case design files that would include names tied to specific dental work orders, alongside production files used to programme milling machines. Those are the files a dental lab uses to cut a physical crown from a ceramic block.

Every figure and category here comes from the attackers' own post, written specifically to pressure the company. Ransomware leak listings are sometimes exaggerated, occasionally outright false. Nothing has been independently confirmed.

How fast is N0n growing?

Very fast, at least by claimed victim count. We first covered N0n on 1 October 2026, when the group listed a Houston endocrinology practice; a 12 October listing targeting a New York telehealth firm came with a 48-hour data deadline. BladeTech is the third N0n claim we have reported.

Transportation has been the group's most frequent target. A dental lab falls outside that pattern. Volume and verification are in tension with a group moving this fast: the failure mode is treating every listing as a confirmed breach. Some won't be.

Should patients or staff be worried?

The claim is unconfirmed, so there's no established breach to react to. Even so, the kind of data N0n describes, names attached to dental records, is useful to criminals running scam calls or fake emails.

If you're a patient of a dental practice that uses BladeTech as its laboratory partner, watch for unexpected calls or messages claiming to offer "data breach compensation" or asking you to verify personal details. That is a scam pattern criminals run whether or not the underlying breach is real. Don't reuse passwords across accounts, and treat any unsolicited outreach about your dental records with scepticism until BladeTech or your dentist says something official.

A 30-day burst of 105 claimed victims from a single group is the kind of spike that usually precedes either law-enforcement action or a wave of copycat listings. Right now nobody outside the group knows which way this goes.