The N0n extortion group has published data it says it stole from Max Fashion, the UAE-based value fashion chain owned by Landmark Group. QPulse reports the leak contains 3,059,929 distinct loyalty-programme records with names, email addresses, phone numbers and dates of birth. The leak site was posted on 6 November 2026. Ransomware.live, which tracks extortion sites, has marked the listing "[NOT PAID — EXPOSED]", which suggests no ransom was paid and the files have been released. Max Fashion and Landmark Group have not commented in public, and no UAE regulator has published a notice. The record count comes from analysis of the leaked files, not from the company. Until Max Fashion confirms or disputes it, treat it as the attacker's claim backed by third-party review of the dump.
What Happened
ThreatMon, Exeo and Ransomware.live all recorded N0n adding Max Fashion to its leak site on 6 November 2026. Undercode News, citing ThreatMon, lists the victim as a UAE fashion and retail company. Exeo calls it a retail and e-commerce business. Security Arsenal says the Max Fashion posting was one of 15 new N0n listings published between 4 and 6 November, covering victims in the UAE, the US, Canada, Denmark, Indonesia and Germany. Other named victims in that batch include Hallmark Cards, The Container Store, Delta Dental of Missouri and Scry Analytics.
There may be an earlier link. On 3 November, QPulse reported that N0n had listed an unnamed "Company #119", described as a Middle East "value fashion retail" business, with the status "[PENDING EXPOSURE]". That description fits Max Fashion. Gangs often post a victim anonymously first and name them once a deadline passes. However, no tracker or researcher has publicly confirmed that Company #119 and Max Fashion are the same organisation.
Assessments of severity vary. QPulse rates the incident 85 out of 100. Exeo rates it medium. Security Arsenal says the claims in this batch are unverified and that the named companies may dispute them. Undercode News, writing before the data was released, said no technical evidence had been provided at that point.
What Was Taken
According to QPulse's review of the published files, the leak includes:
- Customer identity data: 3,059,929 distinct loyalty-programme records with full names, email addresses, phone numbers and dates of birth.
- Shopper behaviour data: search sessions with the exact queries customers typed and their session identifiers.
- Commercial data: revenue and conversion figures for each search query, plus graphs mapping site navigation to revenue.
- More customer data in the analytics files: at least 1,125 verified customer email addresses found inside the navigation graph data.
QPulse has not reported payment card data, passwords or national ID numbers. None of the other trackers has published its own breakdown of the files. The figure of about 3 million comes from one analysis and has not been confirmed by the company or by a second researcher.
Why It Matters
Names, phone numbers, emails and dates of birth are enough for convincing phishing, SMS fraud and account takeover attempts. That is a particular problem in the Gulf, where scams impersonating delivery firms and retailers are already common. Customers may get messages claiming to be about Max Fashion loyalty points, refunds or orders. Some of those messages could quote real details from the leak.
The commercial data matters too. Search-to-revenue and conversion analytics usually sit in e-commerce platforms, search services or analytics tools, not in a basic customer database. If QPulse's description is right, the attackers reached the backend of the retailer's online store or the third-party services connected to it. Competitors and other criminals could also use that business data.
The incident also shows how fast N0n is growing. SOCRadar says N0n began appearing on leak sites in September. By early November it was posting victims in batches across several sectors and continents, with retail heavily represented.
The Attack Technique
Nobody has said how N0n got into Max Fashion. Exeo notes that the listing does not identify an attack vector. The best guide to how the group works comes from SOCRadar's research, published on 29 October and covered by SOCtember, Xploitwire and Botnet Alert.
SOCRadar found an exposed Python file server at 185.157.161[.]148 on port 8877. It held N0n's working directory in two snapshots taken on 25 and 26 September: 1,719 files, including 829 scripts, the source code for five C++ encryptors, leak-site infrastructure and an AI coding-agent environment. The material links the operator to at least 23 organisations in 14 countries. SOCRadar's main finding was: "No vulnerability exploitation was identified: every documented compromise relied on weak or stolen credentials." Methods documented in the files include:
- Credential stuffing against FortiGate SSL-VPN portals. SOCtember reports 305 targeted FortiGate VPNs. Against US managed service provider ChiBiTek, the operator used a residential SOCKS5 proxy pool running 15 threads to test credential lists.
- Exposed cloud keys. In a case linked to Fanatics, N0n used a leaked AWS access key to pull data from 40 S3 buckets, with up to 110 GB per bucket. It then deleted data, including bank-transaction archives, across 12 sensitive buckets.
- Reused hosting-portal sessions and broad RDP scanning.
- Destruction instead of encryption. Where the group does not encrypt, it deletes data and backups after stealing them.
Security Arsenal describes N0n's methods as VPN exploitation, lateral movement with PsExec, and staging data before encryption. Its mention of "exploitation" does not fit with SOCRadar's finding of no vulnerability use. SOCRadar's evidence comes from the operator's own files, so it is the more specific account. In either case, VPN access is the common starting point. SOCRadar also published detection markers: files renamed with a .n0n extension, a Run registry key named n0nNote, and FortiGate login requests carrying the cookie APBSID=n0n.
The Max Fashion data looks like customer and analytics records, not encrypted servers. That fits the cloud-key and data-theft pattern SOCRadar described. This is an inference, not a confirmed finding.
What Organizations Should Do
- Lock down remote access. Require phishing-resistant MFA on every FortiGate SSL-VPN, RDP gateway and hosting control panel. Review VPN logs for large numbers of failed logins from residential IP ranges, and search for the APBSID=n0n cookie in FortiGate web logs.
- Find and rotate exposed cloud keys. Scan code repositories, CI pipelines and config files for AWS keys. Remove long-lived keys that can delete S3 objects. Alert on bulk ListBucket and GetObject activity followed by DeleteObject calls.
- Keep backups out of reach. N0n deletes backups. Use immutable or offline copies, and make sure the credentials that manage backups are kept separate from domain and cloud admin accounts.
- Monitor loyalty and analytics data stores. Treat search, recommendation and analytics platforms as places that hold personal data. Limit who can export from them in bulk, and alert on large exports.
- Hunt for N0n's markers. Add detections for .n0n file renames, the n0nNote Run key, unexpected PsExec use and large archive files being staged before transfer. Block 185.157.161[.]148.
- Warn customers if you are a Max Fashion partner or the retailer itself. Tell loyalty members to expect phishing and SMS scams that use their real details. Prepare notifications under the UAE's data protection rules in case the record count is confirmed.
Sources: N0n Ransomware Group Leaks Data of 3 Million Max Fashion Customers... | N0n Ransomware Group Claims MAX Fashion as New UAE Victim + Video -... | Ransomware group N0n claims 'Company #119' in value fashion retail... | N0N Ransomware Gang: 15 New Leak-Site Postings Claim Retail, Health... | SOCRadar Says an Exposed n0n Ransomware Workspace Shows Every Docum... | n0n's AI habit cost $7K, leaked its playbook Xploitwire | n0n Ransomware Group Targets FortiGate and AWS via Stolen | Ransomware N0n listed victim: Max Fashion - Exeo