Higginbotham: N0n Extortion Group Claims Leak of 217,000 Brokerage Documents

"The N0n extortion group has listed Higginbotham, a large U.S. insurance brokerage, on its leak site. The group says it has published more than 217,000 client policy and working documents dated from 2013 through 2026…"

The N0n extortion group has listed Higginbotham, a large U.S. insurance brokerage, on its leak site. The group says it has published more than 217,000 client policy and working documents dated from 2013 through 2026. The posting appeared on November 7, 2026, and QPulse and DataBreachRights report that it was marked "NOT PAID — EXPOSED," which suggests the group released the files after ransom talks failed or never happened. The breach is not confirmed. Higginbotham has not commented publicly, no regulator filing or breach notification has been published, and no independent researcher has said they checked the leaked files. Everyone reporting the 217,000 figure is quoting it from the group's own listing.

What Happened

ThreatMon, as cited by Undercode News, and Security Arsenal, which tracks leak sites using ransomware.live data, both saw N0n add Higginbotham to its victim list on November 7. Security Arsenal says the listing was part of a wave of 19 organisations N0n posted between November 5 and 7. The others included Staples, Hallmark Cards and the Italian drug maker Dompé Farmaceutici. A second leak-site crawler independently saw all 19 postings. That confirms N0n made the claims. It does not confirm that any of the named organisations were breached.

Reports also differ on what was actually released. QPulse and DataBreachRights describe a listing that gives file counts and data categories and says the data is exposed. The ThreatMon-based report from Undercode News says it saw no evidence of published files and calls the posting an unverified victim claim. Nobody has publicly said when the intrusion happened or how the attackers got in. QPulse gives November 7 as both the discovery date and the estimated attack date, but that date most likely comes from the leak posting, not from any investigation.

What Was Taken

N0n's listing, as described by QPulse and DataBreachRights, claims the following:

More than 217,000 client policy and working documents from 2013 to 2026, which the group calls a complete "correspondence attachment store"
Workers' compensation and property policy files tied to named clients
Underwriting questionnaires sent to insurance carriers
Producer reports with client codes, names and policy numbers
Producer emails with commission, prospect and employee benefits information
Client reference lists and what the group calls full customer relationship (CRM) databases

Neither the number of people affected nor whether regulators have been notified has been disclosed. If the claims are accurate, the data is especially useful to fraudsters. Real policy numbers, carrier names and producer details would let them write convincing phishing emails, fake renewal and premium notices, and invoice fraud aimed at Higginbotham's commercial clients. Workers' compensation and benefits files may also contain employees' personal and medical information.

Why It Matters

N0n first appeared in September 2026. Cyberint first observed it on September 18, and ZeroFox saw its Tor leak site go live on September 21. The group has grown quickly since. Cyberint counted 120 listed victims in 28 countries by October 19. ZeroFox found that technology and professional services firms together made up 46 percent of the group's targets, so an insurance brokerage fits its pattern.

Researchers disagree on how to classify the group. Fortra, as summarised by PlainSec, notes that reporting is split between calling N0n a ransomware operation and calling it a pure data-extortion group. SOCRadar found five encryptor source files in the group's exposed workspace and says that when N0n does not encrypt, it destroys data and backups after stealing them. ZeroFox points to the group's threats against backups as its distinguishing feature, but says it is unclear whether N0n can actually reach them.

Cyberint also warns that some of the group's listings may be inflated. N0n posted 38 maritime and logistics firms in one wave on October 12. Cyberint thinks those listings may come from one shared application or vulnerability rather than 38 separate intrusions, which matters when deciding how much weight to give any single claim, including this one. Brokerages are a concentrated target: one breach exposes the data of many client businesses and the carriers they work with.

The Attack Technique

How N0n got into Higginbotham, if it did, is unknown. The group's documented methods are consistent across researchers:

Stolen and weak credentials. ZeroFox, Cyberint and Fortra all say N0n mainly gets in using logins already stolen by infostealer malware. SOCRadar analysed an exposed N0n working directory found on a misconfigured server at 185.157.161[.]148:8877. It reported that "no vulnerability exploitation was identified: every documented compromise relied on weak or stolen credentials." That included password-guessing attacks against 305 FortiGate VPNs and the use of exposed AWS keys.
Living off admin tooling. After getting in, the operators move through networks using Remote Desktop Protocol (RDP) and standard administration tools, according to Fortra. ZeroFox says they then raise their privileges, gather and stage data, and make their demand. The activity can look like normal administrator work.
AI-assisted scripting. SOCRadar found 829 scripts and an AI coding agent environment among 1,719 files, which it linked to at least 23 organisations in 14 countries.
Detectable artefacts. SOCRadar published detections for files renamed with a .n0n extension, a Windows Run key named n0nNote, and FortiGate login requests carrying the cookie APBSID=n0n.

What Organizations Should Do

Treat remote access as the front door. Require phishing-resistant MFA on VPNs (FortiGate in particular), RDP gateways and cloud consoles. Alert on password-guessing patterns and on FortiGate logins carrying APBSID=n0n.
Hunt for infostealer exposure. Check commercial and public infostealer log feeds for corporate credentials and session tokens. Force resets and revoke sessions for anything that turns up, including accounts held by contractors and service providers.
Rotate and lock down cloud keys. Search code repositories and file shares for exposed AWS access keys, rotate any long-lived keys, and alert on API calls from unfamiliar locations.
Protect backups from the network they back up. Keep backups offline or immutable, with separate credentials, and test restores. N0n specifically threatens to destroy backups.
Watch document stores and CRM exports. Alert on bulk downloads from document management, email attachment stores and CRM systems, and add SOCRadar's .n0n rename and n0nNote Run key detections to your endpoint tools.
For Higginbotham clients and partners: expect phishing that quotes real policy details. Verify any request to change payments or bank details through a known phone number, and watch for fraud tied to employee benefits and workers' compensation records.

Sources: N0n Ransomware Group Leaks Over 217,000 Documents from Insurance Br... | N0n Claims Higginbotham as New Ransomware Victim in the United Stat... | Higginbotham Data Breach Claim: What Was Exposed | N0N Ransomware Gang: 19 New Victims Posted — Retail, Tech & Healthc... | Threat Actor Investigation n0n | Flash Report: Emerging Threat Actor Targets Data Backups ZeroFox | n0n extortion group expands leak site with stolen data · PlainSec | SOCRadar Says an Exposed n0n Ransomware Workspace Shows Every Docum...