Ransomware Group N0n Claims Attack on New York Telehealth Firm, Sets 48-Hour Data Deadline
A dark-web listing appeared on 11 October 2026, giving the unnamed company roughly two days before the group threatened to publish stolen data. No public confirmation exists.
Key points
- Ransomware group N0n listed a New York-based telehealth and confectionery company on its dark-web leak site on 11 October 2026, threatening to publish data at 09:40 UTC on 13 October 2026.
- The claim is unverified; the company has not publicly confirmed any incident as of publication.
- N0n has now claimed at least two healthcare-adjacent victims in under two weeks, following a listing we reported on 1 October 2026.
- Ransomware groups routinely post listings to pressure victims into paying; listings are sometimes exaggerated or false.
- Healthcare-adjacent businesses handle sensitive patient and customer data, making any breach claim worth taking seriously while facts remain unclear.
A ransomware group calling itself N0n has claimed responsibility for an attack on a company it describes as operating in telehealth and confectionery in New York, according to a listing observed by the monitoring service Ransomware.live on 11 October 2026. Ransomware is malicious software that criminals use to lock a company's files and systems, then demand payment for the key. A countdown in the group's post set publication of allegedly stolen data for 09:40 UTC on 13 October 2026, roughly 48 hours after the listing appeared.
The company has made no public statement, and the claim could not be independently verified at publication time.
How serious is this group?
N0n is moving fast. We first reported on the group on 1 October 2026, when it claimed a Houston endocrinology practice as a victim. Two healthcare-adjacent listings in under two weeks is a pattern worth tracking, though volume alone says nothing about accuracy. Listings are written by attackers as pressure tactics and are occasionally fabricated outright.
Why does telehealth make this claim particularly sensitive?
Healthcare-adjacent companies typically hold two kinds of valuable data: personal health information and payment details. Both are useful to criminals, whether for direct fraud or resale. The group's post did not specify what data it claims to hold beyond the broad company description, and this article does not enumerate any alleged data categories beyond what the listing itself states.
| Detail | What the listing says |
|---|---|
| Group | N0n |
| Listing date | 11 October 2026 |
| Threatened publication | 13 October 2026, 09:40 UTC |
| Sector described | Telehealth and confectionery |
| Location described | New York, USA |
| Verified by company | No |
What should customers or staff do right now?
No action is required based on an unconfirmed claim alone, but a few habits are worth adopting while the situation is unclear.
Watch for phishing emails, where criminals send fake messages pretending to be a company representative or a regulator, trying to trick you into clicking a link or handing over a password. If you have an account with a telehealth service based in New York and you reuse that password elsewhere, change it on those other accounts now. Be wary of any unsolicited call or email offering "breach compensation" or asking you to verify your identity; legitimate companies don't cold-call customers this way after an incident.
The deadline is almost beside the point. N0n has shown a clear appetite for healthcare targets, and those records are precisely what criminal markets pay most for. Whether this listing holds up or not, the group's focus warrants close attention.
