Ransomware Group N0n Claims Attack on SMIC US Company, Lists Payroll and Financial Records
The gang behind a fast-moving wave of claimed attacks has added the US arm of one of the world's largest chip makers to its dark-web list. The company has not confirmed any incident.
Key points - Ransomware group N0n listed SMIC US Company, based in Sunnyvale, California, on its dark-web leak site on 18 October 2026, claiming to have stolen corporate records, payroll files and financial documents. - N0n has appeared on our radar three times since we first covered the group on 1 October 2026, and this is its second listing we've reported in two days. - Transportation is the sector most often targeted in N0n's claimed victim list, though Manufacturing now features prominently. - SMIC US Company has made no public statement about the claim, and it could not be independently verified at publication time. - The listing was observed by the monitoring service Ransomware.live.
A ransomware group called N0n has added SMIC US Company, the American subsidiary of China-based Semiconductor Manufacturing International Corporation, to its dark-web leak site. The listing appeared on 18 October 2026. Ransomware is malicious software that criminals use to lock or steal a company's files, then demand payment to stay quiet. A dark-web leak site is a pressure page the group runs in a part of the internet unreachable by ordinary browsers, used to name companies and push them toward paying.
What does the group claim to have taken?
The group's post describes stolen material in three broad categories: corporate business and working files, employee and payroll records, and financial and accounting documents. It marks the entry "NOT PAID, EXPOSED", meaning the criminals assert data has been or will be released without a ransom. These descriptions come from the attackers. Treat them skeptically.
SMIC US Company hasn't publicly confirmed any incident. No statement from the company existed at the time of publication.
How active is N0n right now?
Very. Our first N0n story on 1 October 2026 covered a claimed attack on a Houston endocrinology practice. Yesterday we reported a claimed attack on Missouri dental lab BladeTech Inc. That pace suggests either a genuine operational surge or an aggressive run of pressure listings built on older, partial data. Which applies here isn't clear.
Transportation has been N0n's most frequently listed sector, but the SMIC US Company entry puts Manufacturing squarely in the mix.
| Metric | Figure |
|---|---|
| Threat Vectr N0n stories | 3 |
| First N0n coverage | 1 Oct 2026 |
| SMIC US listing date | 18 Oct 2026 |
| Monitoring source | Ransomware.live |
Should you worry if you work with SMIC US?
The claim is unverified. The practical steps are the same either way. Watch for phishing emails: criminals use news of a claimed breach as bait, sending fake company notices designed to harvest passwords or push recipients into clicking malicious links. Don't reuse passwords across work and personal accounts. Change personal ones now if you do. Be wary of any call offering "breach compensation" or asking you to confirm personal details; that's a standard follow-on scam.
If a verified breach involving US residents' personal data is eventually confirmed, the FTC (the Federal Trade Commission, which oversees data-security obligations for US businesses) would have jurisdiction. No regulatory action has been reported.
