The data-extortion group N0n added LiveRamp, the US data-connectivity and identity-resolution company, to its leak site on 11 November 2026. The group says it holds 2.2 terabytes across 39,055 files. It describes the haul as identity-graph feeds, client audience files and 19.2 million hashed email identities that it says are linked to named individuals. The listing is marked "NOT PAID — EXPOSED", the label the group uses when it says a victim refused to pay and the data has been published. LiveRamp has not publicly confirmed a security incident. No regulator filing or breach notification has been published, and threat intelligence firm ThreatMon flagged the listing without independently verifying it. Everything below about the data comes from the attackers' own description.
What Happened
Several leak-site trackers recorded the LiveRamp listing on 11 November, among them ThreatMon, DeXpose and QPulse. ThreatMon reports that N0n named betting operator DraftKings in the same round of listings. QPulse logs the incident as discovered at 01:00 UTC that day.
Accounts differ on whether any data has actually been released. QPulse and DeXpose describe the data as leaked and exposed, based on the listing's "NOT PAID — EXPOSED" status. Undercode News and The Daily Byte report that no sample data has been published and that the listing description is incomplete. Neither outlet could confirm that any files are available for download. Until the dataset has been independently checked, treat this as a claimed leak rather than a confirmed exposure.
Undercode News also links the listing to an earlier one. On 2 November, N0n posted an unnamed victim called "Company 116", described as a US data collaboration and identity-resolution company. The new LiveRamp entry appears to name that organisation. No one has independently confirmed the link. If it holds, the group had been pressuring LiveRamp for about nine days before naming it.
What Was Taken
The listing claims the following, all dated October 2026:
- Identity-graph feeds: 39,055 files totalling 2.2 TB, which the listing says were "delivered to the organization"
- Client audience delivery files: 1,006 files totalling 220.5 GB, covering purchase, streaming (OTT), demographic and predictive segments
- Hashed email identities: 19.2 million in those audiences, which the group says were resolved to named individuals
- Device refinement feeds and daily compliance opt-out feeds
The Daily Byte points out that a file count is not a count of affected people. The listing also doesn't show whether the records are current, out of date or duplicated. Without samples, nobody outside the group can check what it holds.
If the claim is accurate, the data is sensitive in a particular way. Identity graphs link email addresses, mobile advertising IDs, device identifiers and customer references from different brands into one profile per person. Per-client audience files would also expose the targeting strategy of LiveRamp's customers. The compliance opt-out feeds are a concern in their own right, because they list the people who asked not to be tracked.
Why It Matters
LiveRamp sits in the middle of the advertising data supply chain, so a confirmed breach would reach well beyond one company. Brands and publishers that send data through it would have to assess their own exposure, which may include contractual and privacy-law obligations to the consumers in their segments.
"Hashed" does not mean anonymous. Email addresses are usually hashed with unsalted SHA-256 so that different parties can match the same person. Anyone holding a list of known addresses can hash them and compare the results, and the group already claims to have tied the hashes to named people. Combined with purchase and demographic segments, that data would make targeted phishing and social engineering much easier.
The listing also fits a pattern of large claims from a new group. Cyber Daily reports that N0n first appeared in September 2026. On 3 November it claimed to have taken more than a terabyte from Expedia, including loyalty-programme tables of more than 830 million rows. Expedia declined to comment. Fortra, as summarised by LiveThreat, lists earlier claimed victims including a PayPal support platform, a Venezuelan ISP, an e-commerce retailer, a marketing-analytics SaaS provider and a cloud-hosting firm. Few of these claims have been verified.
The Attack Technique
Nobody has said how LiveRamp might have been breached. What is known about N0n's methods comes from other incidents, and accounts differ on some details.
- Stolen credentials and legitimate tools: Fortra's research, summarised by LiveThreat, says the group logs in with harvested usernames and passwords, then moves through networks using legitimate admin tools and RDP sessions. Fortra describes it as double extortion without a traditional ransomware payload: the group threatens to publish data and to destroy backups.
- Operator security failure: OSec's 12 November weekly report says a N0n operator left their own server exposed. That server revealed attacks on 23 organisations in 14 countries. OSec says the operator stole data, encrypted it and sometimes deleted it, including backups. That conflicts with Fortra's view that the group doesn't deploy ransomware.
- AI-assisted tooling: According to OSec, the operator used the AI coding agent OpenCode to write and debug scripts and had spent more than $7,216 on AI usage by 22 October. OSec stresses that most of the compromises it documented still relied on weak or stolen credentials.
- Edge devices: OSec mentions outside reports that the group exploits vulnerabilities in edge devices, but says those reports have not been verified.
What Organizations Should Do
- LiveRamp customers and partners: Ask LiveRamp directly whether your audience files or feeds were in the October 2026 data. Review your data processing agreements for breach-notification terms so you are ready to act if the claim is confirmed.
- Harden privileged access: Require phishing-resistant MFA on every admin console, VPN, RDP gateway and cloud management plane. N0n's documented attacks start with valid credentials.
- Monitor admin-tool use: Alert on unusual RDP sessions, remote-management tools running outside change windows, and large outbound transfers from data-delivery or file-transfer systems.
- Protect backups: Keep backups immutable and offline, and test restores regularly. Both Fortra and OSec report that the group threatens or deletes backups.
- Check for exposed credentials: Search infostealer logs and credential dumps for your staff and service accounts, and rotate anything that appears.
- Prepare for targeted phishing: If your customers are in ad-tech audience segments, warn them about lures based on their purchase or demographic profile.
Sources: Ransomware Group N0n Leaks 2.2 Terabytes of Data Stolen from LiveRa... | Exclusive: Cyber extortion group claims breach of Expedia, millions... | N0n Ransomware Group Strikes LiveRamp - DeXpose | LiveRamp Named by n0n Extortion Group in Alleged Identity-Graph Dat... | N0N Extortion Group Claims LiveRamp and DraftKings as New Victims i... | n0n Extortion Gang Leverages Stolen Credentials to Threaten Data Le... | N0n Names LiveRamp and DraftKings in Leak Claims | Weekly situation report: 11/9/26 OSec