The data-extortion group N0n has added U.S. home storage retailer The Container Store to its leak site and published data it says it stole from the company. The Container Store has not commented, and no regulator filing or breach notification has been published. According to the threat-intelligence aggregator QPulse, the leaked material includes 46,013 typed customer chat messages, 9,305 named customer email addresses from the company's account portal, search analytics and a staff directory. No independent party has verified those figures. ThreatMon first flagged the listing on November 5, 2026. Undercode News, which reported the ThreatMon alert, stresses that the claim is unverified and that a leak-site listing alone does not prove data theft took place.
What Happened
N0n posted The Container Store as a new victim on November 5, 2026. QPulse reports that the listing is marked "NOT PAID — EXPOSED", which means the group says it published the data after the retailer did not pay. QPulse gives the attack date as the same day the listing appeared. That is more likely the date the listing went up than the date of the intrusion. No source has said how or when the attackers got in.
N0n is a recent arrival. According to CYFIRMA, it launched its Tor leak site on September 18, 2026. By mid-October CYFIRMA had counted 76 leak-site entries, which it estimates cover 64 to 66 separate organisations once duplicate posts are removed. The group's past listings have not always matched real intrusions:
- Maritime batch: On October 12, N0n posted 38 maritime and logistics firms within 23 minutes, all with the same deadline. Maritime security firm Cydome found that at least 21 of them are customers of one Korean software vendor, CyberLogitec. Cydome suspects N0n split a single dataset into many separate "victims", though it says this is not confirmed.
- Some real access: CYFIRMA cites public reporting that Korea's internet security agency, KISA, has been notifying named Korean port companies, and that at least one firm has acknowledged receiving an intrusion notice. CYFIRMA calls this the first outside sign that some of N0n's claims reflect actual break-ins.
Readers should treat the Container Store listing the same way: the data may well be real, but the scope, the source of the data and whether the retailer's own network was breached are all unconfirmed.
What Was Taken
QPulse describes the leaked data as follows:
- Shopper chat corpus: 46,013 typed customer messages.
- Search session analytics: this includes revenue-per-query data, which is commercially sensitive.
- Customer email addresses: 9,305 named addresses that appear to come from the customer account portal.
- Staff directory: an internal directory of employees.
No source mentions payment card data, passwords or government ID numbers. Even so, chat logs often contain order details, addresses and phone numbers that customers typed themselves. Pairing those messages with named email addresses gives criminals what they need for convincing phishing. The staff directory adds a second set of targets for social engineering of employees.
These figures come from a single aggregator that is describing the group's own listing. The Container Store has not confirmed any record count, and neither has anyone else.
Why It Matters
This listing is a move into U.S. retail for a group that has mostly been linked to logistics, telecoms and outsourcers. SOCRadar's analysis of N0n's exposed working files tied the operator to at least 23 organisations in 14 countries. The Register reports that in one case linked to e-commerce company Fanatics, the attackers pulled data from 40 cloud storage buckets and then deleted it.
Researchers disagree about what kind of threat N0n is:
- Encryption tools: SOCRadar found five C++ encryptor source files in the operator's workspace. CYFIRMA said that, as of mid-October, it had not found an encryptor or ransom note linked to the group.
- Labelling: In Fortra's write-up, CyberXTron calls N0n a "double extortion" crew, while SOCRadar describes it as focused on data theft without traditional ransomware.
- What is consistent: SOCRadar and The Register both report that the group deletes data and backups after stealing them in at least some cases.
For defenders, that last point matters more than the label. N0n's damage can be permanent data loss, not just encrypted files.
The Attack Technique
N0n has not said how it got into The Container Store. What is known about the group's methods comes mainly from SOCRadar, which found a Python file server at 185.157.161[.]148, port 8877, exposing the operator's working directory. The directory held 1,719 files, including 829 scripts. The Register reports that the operator spent more than $7,000 on AI services and used an AI coding agent to write much of its tooling.
SOCRadar's chief information security officer, Ensar Seker, told The Register: "In every documented compromise in this investigation, access relied on weak or stolen credentials." SOCRadar found no evidence that the group exploited any software vulnerability. Its documented ways in were:
- VPN credential stuffing: automated login attempts against FortiGate SSL-VPN portals, which SOCtember reports covered 305 devices. The attempts were routed through residential SOCKS5 proxies.
- RDP scanning: large-scale scanning for exposed Remote Desktop Protocol services.
- Exposed cloud keys: leaked AWS access keys with permission to read and delete storage buckets.
- Reused hosting sessions: logged-in hosting portal sessions that the attackers were able to reuse.
Fortra adds that the credentials appear to come from infostealer malware. Once inside, the attackers move around using legitimate admin tools and RDP.
SOCRadar also published detections, as reported by SOCtember:
- files renamed with a .n0n extension
- a Run registry key named n0nNote
- FortiGate login requests that carry the cookie APBSID=n0n
What Organizations Should Do
- Put MFA on every remote entry point. This means VPN (especially FortiGate SSL-VPN), RDP, Citrix and cloud admin consoles. Every intrusion SOCRadar documented relied on credentials alone.
- Check for infostealer exposure. Compare staff and contractor credentials against infostealer logs, then reset any matches and end their active sessions.
- Search for leaked cloud keys. Look for exposed AWS keys in code repositories and build pipelines. Rotate any you find, and remove delete permissions from keys that only need read access.
- Deploy SOCRadar's detections. Alert on .n0n file renames, the n0nNote Run key and FortiGate logins carrying APBSID=n0n. Watch for repeated failed VPN logins coming from residential IP ranges.
- Keep backups out of attackers' reach. Store at least one copy offline or in immutable storage, separate from domain and cloud admin accounts, because this group deletes backups.
- Prepare retail customers for phishing. If you run customer chat or support systems, review who can access those transcripts. Warn customers about phishing that refers to their real orders or past chats.
Sources: N0n Ransomware Group Leaks Data from The Container Store QPulse | Crim spent $7K+ on AI services in extortion attacks, then left evid... | DarkProject Claims Custom Bakehouse as New Ransomware Victim, While... | n0n Ransomware: What You Need to Know Fortra | n0n Ransomware Lists ONE, Pelindo's ILCS and NCT Kandla Among 38 Ma... | N0n Extortion Group Targets Global Shipping - CYFIRMA | n0n hackers demand up to $14 mn from 38 shipping and port firms in... | SOCRadar Says an Exposed n0n Ransomware Workspace Shows Every Docum...