Amagi Media Labs is a Bengaluru-based media SaaS company that listed on Indian exchanges in January 2026. On 22 October 2026 it told the stock exchanges that a threat actor claims to have stolen "operational and network configuration data" relating to some of its systems and is threatening to publish it unless paid (The Economic Times, MediaNama, Threat Atlas India). Amagi says it is still checking whether the claim is true. It reports no disruption to its services, no evidence of impact on customer operations and no expected material financial impact. Four days before the filing, a ransomware group called N0n listed Amagi on its leak site (ransomware.live, via ThreatVectr and DeXpose). Amagi's filing does not name the group, and the company has not confirmed that the listing and the filing describe the same incident. No source gives a data volume or a count of affected records or customers.
What Happened
The timeline below combines the sources:
- 18 October 2026: N0n posts an Amagi Media Labs entry on its leak site, first observed by ransomware.live (ThreatVectr, DeXpose). Threat Atlas India says the listing showed no deadline and no proof it could check.
- 19 October 2026: Breach-tracking sites report the claim and note that Amagi had not confirmed any incident (ThreatVectr, DataBreachRights).
- 22 October 2026: Amagi files a disclosure under Regulation 30 of SEBI's listing rules (Threat Atlas India; filing date confirmed by The Economic Times and StockFin). The filing says Amagi is checking the claim and the data samples the extorter sent, has brought in outside cybersecurity experts and legal counsel, and has notified the "relevant authorities", which it does not name. StockFin's summary of the filing adds that Amagi has strengthened its security measures.
Some details remain unknown or inconsistent:
- When the threat arrived: Amagi has not said when it received the extortion threat (MediaNama).
- Whether a payment was demanded: Business Upturn, writing about a social media statement, says the company did not confirm whether a ransom was demanded. The exchange filing, as reported by The Economic Times and MediaNama, says the threat was to publish the data unless a payment was made.
- Whether the data has already leaked: DeXpose and DataBreachRights describe the listing as marked "NOT PAID — EXPOSED", meaning material was reportedly published. Threat Atlas India saw no proof it could verify. Amagi's filing describes the publication as a threat, not something that has happened.
What Was Taken
The descriptions of the stolen data differ by source:
- Amagi's filing: "operational and network configuration data" from some of its systems. It gives no volume and does not say whether customer data is involved (MediaNama, The Economic Times).
- N0n's listing: "network and device configuration files from a US broadcast playout site" and "internal network maps of the site" (DeXpose, ThreatVectr, DataBreachRights). This is the attacker's description and has not been verified.
- Personal data: DataBreachRights headlines its page "Personal Information Reportedly Exposed", but its own table lists the exposed data types as "Not Publicly Disclosed". Threat Atlas India found no claim anywhere of customer personal data, video content or passwords. On current evidence there is no support for a personal-data exposure.
No source gives a record count, file count or data size.
Why It Matters
Amagi's software runs broadcast playout, scheduling, distribution and real-time ad insertion for TV networks, studios, sports leagues and FAST/CTV platforms. Its IPO prospectus listed more than 400 content providers, 300 distributors and 80 advertisers across more than 40 countries as of 31 March 2025 (MediaNama). On the same day as the incident filing, Amagi also announced that NDTV had adopted its AdFlow Orchestrator (StockFin).
Even if no personal data was taken, network maps and device configurations of a playout site would be useful for planning a later attack. They can expose network layout, management interfaces, firmware versions and trust relationships with customer infrastructure. MediaNama notes that Amagi has not said whether client data or client environments are involved.
N0n is an active group. ThreatVectr says this is its third story on the group in three months and that N0n has listed victims in 11 sectors, most often transportation. ThreatVectr also warns that leak-site claims are sometimes exaggerated or false.
The Attack Technique
No source discloses how the attacker got in. Neither Amagi nor N0n has described the initial access vector, how long the attacker was inside, or whether any ransomware was deployed. DataBreachRights categorises the incident as "ransomware", but it offers no evidence of encryption, and Amagi reports no service disruption. Based on what is known so far, this looks like a data-theft-and-extortion case. If N0n's description is accurate, the target may have been the infrastructure of a single US playout site rather than Amagi's core cloud platform. That is unconfirmed.
What Organizations Should Do
- Amagi customers: Ask Amagi in writing whether your playout, ad-insertion or delivery environments, or any network or device configuration data about them, are in scope. Do not wait for public updates.
- Rotate anything that may appear in the configs: If you share connectivity with a media vendor, rotate credentials, SNMP community strings, VPN pre-shared keys and API tokens that could be embedded in device configurations.
- Treat leaked network maps as reconnaissance: Review exposed management interfaces, flatten unnecessary trust paths, and add detection for access to broadcast and playout management systems from unexpected sources.
- Check vendor remote access: Audit third-party remote access paths into broadcast facilities, enforce MFA, and restrict them to named, time-bound sessions.
- Monitor leak sites and threat intel feeds: Watch for N0n, Amagi or your own organisation's name. Prepare a plan for verifying extortion samples before your organisation is the one named.
Sources: Amagi Media Labs faces extortion attempt, operational data stolen -... | Amagi Media Labs: Amagi Media Labs faces extortion attempt followin... | Amagi Media Labs: an extortion claim, what is confirmed and what is... | Amagi Media Labs hit by suspected cyber extortion attempt: What hap... | Amagi Media Labs (AMAGI) — Announcement, 22 Oct 2026 | Amagi Media Labs Data Breach Claim Investigated | Ransomware group N0n claims attack on Amagi Media Labs · ThreatVectr | N0n Ransomware Group Targets Amagi Media Labs - DeXpose