The N0n extortion group added Infutor Data Solutions, a US broker of consumer identity data, to its leak site on November 7, 2026. The group says it stole and published large consumer datasets. Its listing, tracked by Ransomware.live and repeated by several monitoring services, describes a warehouse table of more than 1.7 billion consumer rows with names and dates of birth, a consumer address table of more than 1.1 billion rows, and client delivery credentials stored in plaintext. None of this has been verified. Infutor has not commented publicly, no regulator filing or breach notification has been published, and no established security outlet has independently confirmed the intrusion. The company has also disputed earlier breach claims this year. Read every figure below as the attacker's claim, not as an established fact.
What Happened
Ransomware.live recorded the listing early on November 7, 2026 (UTC). Within hours, aggregators including QPulse, HookPhish, Breach House, ShadowTelemetry, Cyber Security News and Undercode News picked it up. Undercode News credits the ThreatMon Threat Intelligence Team with reporting the listing and says the claim "has not been independently verified."
Accounts differ on whether any data has actually been published:
- QPulse and HookPhish mark the victim as "not paid, exposed." That suggests a ransom deadline passed and the data was released.
- Breach House captured a screenshot of the leak site. It says Infutor appears in N0n's "Active" section but records the leak status as "pending" and the publication as "not verified."
- ShadowTelemetry rates the item medium priority and recommends that readers validate the exposure scope before acting. QPulse scores it 95 out of 100.
The listing also comes after earlier disputed claims about Infutor. Delist.ai summarises them:
- March 2026: SOCRadar reported an unauthenticated Elasticsearch server holding about 676.8 million indexed US identity records (roughly 92 GB). SOCRadar did not identify the owner and said the number of unique people was unverified. Later secondary coverage, forum posts and class-action marketing linked the archive to Infutor. Some press coverage also used ActiveProspect or Verisk-related corporate names. That attribution remains contested.
- August 24, 2026: Decryption Digest retracted its own Infutor breach reporting. According to that outlet, Infutor said an independent review by Forvis Mazars found no evidence of unauthorised access to its in-scope systems and could not back up the forum leak claims.
The N0n listing is a separate claim made months later. Whether it describes a new intrusion, repackages earlier exposed data, or is fabricated is unknown.
What Was Taken
N0n's listing, as reproduced by Ransomware.live, HookPhish, QPulse and Cyber Security News, claims the following. These are row counts, not counts of people. Data brokers keep duplicate and historical records, so the number of unique individuals would be much lower.
- Core identity records: names, street addresses, phone numbers, birth years and email addresses, described as "millions of rows."
- Warehouse table: more than 1.7 billion consumer rows with names and dates of birth.
- Consumer address table: more than 1.1 billion rows.
- Survey responses: a production table of 590,404,149 rows of consumer survey response data.
- State-level delivery work files: 203,505,791 rows containing names, birth years, cleartext emails and IP addresses.
- Property scoring table: 151,864,181 rows with names, phone numbers, addresses and property values.
- Enriched consumer leads: one file with 13,660 unique email addresses and another with 102,062 full identity records (100,957 unique emails).
- Internal data inventory: a list showing which production tables hold personal data, including tables that hold Social Security numbers. The listing does not claim that the Social Security number tables themselves were taken.
- Merchant brand spending affinity data.
- Client delivery credentials stored in plaintext.
No independent researcher has published an analysis of sample files. Nobody has yet tested whether the data is new, overlaps with the archive SOCRadar found in March, or was assembled from older public leaks.
Why It Matters
Data broker breaches spread widely. Infutor's business is linking names, addresses, phone numbers, emails and birth dates into identity profiles. If this data is real and current, it is well suited to targeted phishing, SIM-swap pretexting, account recovery fraud and synthetic identity fraud. The people affected are mostly consumers who have never dealt with Infutor directly and will not know their data was held.
The plaintext credentials are the most urgent claim for businesses. If the "client delivery credentials" are genuine, they could give attackers a way into the file transfer endpoints, cloud buckets or APIs that Infutor's business customers use to receive data. That is a supply chain risk: one broker's leak becomes a route into many customers' systems. QPulse calls this the most critical part of the listing.
The SSN inventory works like a map. Even without the Social Security number data itself, a list of which tables hold it tells an attacker exactly where to look.
Be sceptical, but do not ignore it. Infutor has rejected one earlier claim, backed by a third-party review, and at least one outlet retracted its coverage. Extortion groups sometimes exaggerate or recycle data. The detail in this listing, with exact row counts and named table types, is more specific than a typical empty claim, but specificity does not prove anything. Defenders should prepare for the credential risk now rather than wait for a company statement.
The Attack Technique
How N0n got the data is unknown. The group has not described its access method, Infutor has made no statement, and no incident response firm or national CERT has published any findings. Nothing confirms that any files were encrypted. The listing reads like data theft and extortion.
Two possibilities are worth tracking, and neither is confirmed:
- Exposed or misconfigured data stores. The Elasticsearch server reported in March shows that large US identity datasets attributed to Infutor have sat online without authentication before. A similar misconfiguration, or reuse of that archive, would explain bulk data without any network intrusion.
- Credential abuse. The presence of plaintext delivery credentials in the listing suggests weak secrets management. Stolen or reused credentials are a common way into data pipelines and file transfer systems.
What Organizations Should Do
- Rotate any credentials shared with Infutor now. If you receive data from Infutor (or from ActiveProspect or Verisk-linked services that deliver Infutor data), rotate SFTP passwords, API keys, cloud storage access keys and any other delivery credentials. Do not wait for confirmation. The cost of rotating is low and the claimed exposure is direct.
- Review access logs on data delivery endpoints. Look for logins from unfamiliar IP addresses, unusual download volumes, or access outside normal delivery windows over recent months.
- Ask Infutor directly for a written answer. Use your contract and data processing agreement to request a statement on whether its systems or customer credentials were affected, and whether the SOCRadar archive or the N0n listing involves data it holds.
- Prepare for more convincing phishing. Warn customer support, finance and IT helpdesk staff that attackers may have accurate names, addresses, birth dates and phone numbers. Tighten identity checks for password resets and account changes so they do not rely on details a data broker would hold.
- Strengthen fraud controls if you serve consumers. Banks, telecom carriers and online retailers should watch for spikes in account takeover attempts, SIM-swap requests and new-account fraud using identity data that looks legitimate.
- Check your own secrets management. Use this incident as a reason to scan file shares, data warehouses and delivery scripts for plaintext credentials. Move them into a secrets manager with rotation and access logging.
Sources: N0n Ransomware Group Exposes Massive Datasets from Infutor Data Sol... | Infutor Data Solutions Data Breach: N0n Ransomware Claim (Nov 2026) | Infutor Data Solutions — N0N Ransomware Attack Breach House | Infutor data breach (2026): what was exposed and what to do Delist.ai | N0n Ransomware Group Claims Infutor Data Solutions as New Victim in... | Ransomware.live – Victim: Infutor Data Solutions – ShadowTelemetry | 🏴☠️ N0n has just published a new victim : Infutor Data Solutions