The extortion group N0n says it stole a complete claims data warehouse from the US ophthalmology business of Dompé Farmaceutici S.p.A., the Italian biotechnology and specialty pharmaceutical company. The group added the company to its leak site on 6 November 2026. The tracker ransomware.live recorded the listing at 10:54 UTC that day, and RansomLook logged it on the same date. The group says the data includes patient tables and years of prescription, procedure and diagnosis claims. Dompé has not commented. No regulator filing or breach notification has been published, and no outlet has independently checked the data. This is a claim by the attackers. It has not been confirmed as a breach. No record count, data volume or ransom figure has been given.
What Happened
ransomware.live and RansomLook both describe the entry the same way: victim sector "pharmaceutical (biotechnology and specialty)", location "Italy (United States data)". The listing is tagged "NOT PAID - EXPOSED". N0n uses this label for victims it says did not pay, and it means the group says it has already published the data. QPulse and The Daily Byte read the tag the same way. Neither has confirmed that the published files exist or are real, and Yazoul says it has not verified any part of the claim.
Accounts differ on a few details:
- An earlier entry. RansomLook also lists an N0n entry from 3 November 2026 called "Company #126" with the same victim description. It is not known whether that was an anonymised early listing of Dompé or a different company.
- A second pharma victim at the same time. MedRisk reports that N0n listed Cogent Biosciences, a US clinical-stage oncology company, within about twenty seconds of Dompé. That listing also concerned a patient claims analytics environment, which N0n describes as holding millions of claim rows with patient, claim and provider identifiers. Cogent has not confirmed an intrusion either.
- What the listing contains. The Cybrmonk blog says the post gave no details on data type or volume. That conflicts with the listing text that ransomware.live and several other trackers reproduce, which itemises the data. The fuller description appears on more trackers, so this brief treats it as the listing's actual content.
What Was Taken
According to N0n's description, which ransomware.live reproduces, the data includes:
- Patient dimension tables (the core records identifying individual patients)
- Drug, diagnosis and health plan reference tables
- Full archives of prescription claims
- Full archives of procedure claims
- Full archives of diagnosis claims
The data is said to come from Dompé's US eye-care operations, so any exposure would involve American patients and US insurance claims, not Dompé's Italian operations. N0n has not said how much data it took or how many people are in it. No sample has been authenticated.
If the claim is accurate, this is very sensitive health data. MedRisk points out that claims warehouses are built for analysis: one row can link a named patient to a diagnosis, a prescriber, a pharmacy, a health plan and a date of service. A thief does not need to clean or join the data first. Diagnosis codes also create a risk of discrimination and embarrassment for patients, not just identity theft.
Why It Matters
Regulators. If US patient health information was taken, Dompé's US business may have to notify regulators and affected people under US health privacy and state breach laws. QPulse makes this point too. Whether notification is required depends on the company's role (for example, whether it holds the data as a covered entity or as a business associate of one). That role has not been made public.
A pattern of targeting. The Daily Byte reports that N0n has repeatedly gone after pharmaceutical companies, including an unnamed Danish firm listed a few days earlier. The near-simultaneous Cogent listing points the same way. Two drug developers named over the same type of data, seconds apart, suggests the group is looking for patient analytics environments, which sit outside core clinical systems and may be less closely watched.
Who N0n is. Accounts of the group differ:
- Fortra says N0n first appeared in mid-September 2026 and listed about a dozen claimed victims within days.
- The Daily Byte, citing leak-site trackers, says it listed more than 100 victims in its first two months. The "Company #126" entry on RansomLook fits a count in that range.
- Yazoul calls N0n a low-profile operation with no record it can corroborate and an unknown victim count.
Researchers also disagree on what N0n does. Fortra notes that CyberXTron calls it double extortion: stealing data and threatening to encrypt systems or destroy backups. SOCRadar says it focuses on data theft and extortion without using traditional ransomware. N0n itself claims to shut down networks and destroy backups and shadow copies. Fortra advises caution about those claims. Fortra also notes that N0n's other big claims, including 86.7 million records linked to Transcom and 15.3 million subscriber records from Venezuelan ISP Inter, are also unconfirmed. Yazoul warns that newer groups sometimes exaggerate what they took to pressure victims.
The Attack Technique
Nobody has said how Dompé's environment was accessed, if it was. No one has reported whether any systems were encrypted.
The best description of N0n's methods comes from Fortra's profile of the group. Fortra says its intrusions usually start with valid usernames and passwords harvested by infostealer malware. The group then moves through networks with legitimate admin tools and Remote Desktop Protocol (RDP), not by exploiting unusual software vulnerabilities. The Cybrmonk blog says the group has a history of exploiting weak remote access and unpatched software. That agrees with Fortra on remote access but not on vulnerability exploitation, and Cybrmonk gives no evidence. No YARA rules, detection signatures or technical indicators have been published for N0n, according to Yazoul.
If N0n worked as Fortra describes, a stolen login for a warehouse service account or an analyst account would be enough to copy a claims warehouse. Bulk export would look like normal analytics activity unless someone checks how much data is leaving.
What Organizations Should Do
- Find every copy of identifiable claims data. List the analytics warehouses, data lakes and reporting environments that hold patient-level claims, including third-party and vendor-hosted ones. Check whether they share login systems with production, as MedRisk recommends.
- Lock down warehouse logins. Require multifactor authentication for all human access to analytics platforms. Rotate and restrict service account credentials, and remove standing access for accounts that only need it occasionally.
- Hunt for infostealer exposure. Check infostealer log feeds and credential monitoring services for corporate logins, especially for remote access, cloud consoles and data platforms. Reset any exposed credentials and end their active sessions.
- Watch outbound data volumes. Set baselines and alerts for unusually large queries, exports and data leaving warehouse environments. Pay attention to service accounts and off-hours activity, and review RDP and admin tool use from unusual hosts.
- Cut retention. Ten years of claim rows means ten times as much to lose. Delete or archive identifiable claims older than you need, and de-identify analytics datasets where possible.
- Partners, providers and patients connected to Dompé's US ophthalmology business: wait for an official notice from Dompé, and do not visit or download anything from the leak site. Be wary of phishing emails, calls or texts that mention this claim, and check them through contacts you already have at the company.
Sources: N0n claims drugmaker Dompé patient data theft | Ransomware Group N0n Claims Data Exfiltration from Dompé Farmaceuti... | Dompé Farmaceutici Ransomware Claim by N0n (Nov 2026) | N0n lists two drug developers over claims data – MedRisk | n0n ransomware group claims Dompé Farmaceutici Vulnpocalypse | n0n Ransomware: What You Need to Know Fortra | N0n ransomware claims to have hit Italy’s Dompé Farmaceutici in a f... | 🏴☠️ N0n has just published a new victim : Dompé Farmaceutici S.p.A.