The n0n extortion group has published data it says it stole from Scry Analytics, a US company that provides data analytics and AI services. According to QPulse, which tracks leak site postings, the dump includes core banking records from a US private banking client, a 7,904-record party master file from a global insurance group, and recorded customer support calls with transcripts. The posting appeared on n0n's leak site early on November 6, 2026, marked "NOT PAID — EXPOSED." Scry Analytics has not commented publicly. No regulator filing or breach notification has been published. Neither the affected bank nor the insurer has been named or has confirmed the exposure. For now, what the data contains is n0n's claim, as reported by QPulse.
What Happened
QPulse reports that the listing was detected at 01:22 UTC on November 6, 2026, and puts the estimated attack date on the same day. That date is probably when the data was posted, not when the intrusion took place. Groups like n0n usually spend days or weeks inside a network before they list a victim, and how long the attackers had access to Scry Analytics is not known.
The "NOT PAID — EXPOSED" status suggests either that Scry Analytics refused to pay or that talks failed. According to QPulse, n0n also posted what it presents as proof that Scry held the bank and insurer data under contract. That claim matters because it puts the exposure on the clients, not only on the vendor.
The Scry posting came one day after n0n leaked data it claims came from The Container Store, also reported by QPulse. That listing included 46,013 customer chat messages and 9,305 customer email addresses. The group has been listing new victims at a fast pace since it first appeared. Fortra says n0n surfaced in mid-September 2026 and named about a dozen victims within days. Cyberint dates the first sighting to September 18 and counted 120 listed victims across 28 countries by October 19. Most of those claims have not been independently verified.
What Was Taken
According to QPulse's summary of the leak, the published data includes:
- Core banking customer and signer records from a US private banking client: names, account records, signer roles, addresses and contact details.
- A global insurance group's party master file: 7,904 records of legal entities and the relationships between them.
- Production call recordings and transcripts from a customer support platform run by Scry Analytics, including consumer names and mobile phone numbers.
- Contract evidence that n0n says shows Scry held the bank and insurer data.
No overall volume, file count or number of affected individuals has been published. The 7,904 figure is the only specific count reported, and it covers legal entities, not individual people. Private bank signer records and voice recordings are especially sensitive. Signer roles show who can authorise transactions on high-value accounts, which makes those people useful targets for impersonation, payment fraud and social engineering. Call recordings can be used to clone voices or to script convincing fake support calls.
Why It Matters
This is a supply chain exposure. The bank and insurer did not need to be breached themselves. Their customers' data was taken from a vendor they had contracted to analyse it. AI and analytics firms often receive production-grade customer data for model training, enrichment or support automation, which makes them a single point that holds data from several regulated clients. Cyberint's profile of n0n flags this pattern directly. It notes that organisations that depend on third-party service providers may face more exposure, and suggests that one wave of 38 maritime and logistics listings on October 12 may have come from a single shared application rather than 38 separate intrusions.
Researchers also disagree on how n0n operates. CyberXTron, as cited by Fortra, describes it as double extortion with threats to encrypt or destroy backups. SOCRadar, also cited by Fortra, says the group focuses on data theft and extortion without relying on traditional ransomware. SOCRadar's later analysis of n0n's exposed server, reported by The Register and SOCtember, found five encryptor source code files. It also found that where the group does not encrypt, it deletes data and backups after stealing them. For victims, the practical point is that paying for a decryptor may not be possible, because the data may simply be gone.
The Attack Technique
How n0n got into Scry Analytics has not been disclosed. What is known about the group's methods comes from SOCRadar. Its researchers found a misconfigured Python file server at 185.157.161[.]148, port 8877, that exposed the operator's working directory in snapshots from September 25 and 26. The server held 1,719 files, including 829 scripts, five C++ encryptor sources, leak site infrastructure and an AI coding agent setup. The files tie the operator to at least 23 organisations in 14 countries.
SOCRadar's main finding, which its CISO Ensar Seker repeated to The Register, is that "every documented compromise relied on weak or stolen credentials." It found no exploitation of software vulnerabilities. The methods it documented include:
- FortiGate SSL-VPN credential stuffing against 305 appliances, routed through a 15-thread residential SOCKS5 proxy pool that tested credentials against
/remote/login. - Wide scanning for exposed RDP, followed by movement through legitimate admin tools.
- Exposed cloud credentials. In one case, an AWS access key with list, read and delete permissions was used to pull data from 40 S3 buckets of up to 110 GB each, and the data was then deleted.
- Reuse of hosting portal sessions.
Fortra and PlainSec add that many of the credentials appear to come from infostealer malware logs. Crypto Briefing and The Register report that the operator spent more than $7,216 on AI services and used the opencode coding agent with 154 models to write its tooling. SOCtember reports that SOCRadar published detections for files renamed with a .n0n extension, a Run registry key named n0nNote, and FortiGate login requests carrying the cookie APBSID=n0n.
What Organizations Should Do
- Ask your vendors directly. If you have shared customer, banking, insurance or call-centre data with Scry Analytics, or with any AI or analytics provider, find out what they hold, where they store it, and whether it is still needed. Prepare for possible notification duties under state breach laws and banking and insurance regulations.
- Harden remote access. Enforce phishing-resistant MFA on all SSL-VPN and RDP entry points. Take RDP off the internet entirely. Alert on high-volume failed logins from residential proxy ranges, and hunt for the
APBSID=n0ncookie in FortiGate logs. - Check infostealer exposure. Monitor infostealer log markets for employee and contractor credentials. Force a reset of any credential that turns up, and treat infected unmanaged devices as a route into corporate SSO.
- Lock down cloud keys. Rotate long-lived AWS access keys. Remove delete permissions wherever they are not needed. Turn on S3 versioning and Object Lock for critical buckets, and alert on bulk
ListObjects/GetObjectactivity followed by deletions. - Keep backups out of the attackers' reach. Because n0n deletes data and backups, keep immutable, offline or logically separated copies, and test that you can restore from them.
- Prepare for follow-on fraud. Banks and insurers whose data may be in this leak should warn relationship managers and support staff about callers impersonating signers, and should add extra verification for account changes and payment instructions.
Sources: Ransomware Group N0n Leaks Sensitive Client Data Stolen from Scry A... | Crim spent $7K+ on AI services in extortion attacks, then left evid... | n0n Ransomware: What You Need to Know Fortra | n0n extortion group expands leak site with stolen data · PlainSec | SOCRadar Says an Exposed n0n Ransomware Workspace Shows Every Docum... | N0n Ransomware Group Leaks Data from The Container Store QPulse | Threat Actor Investigation n0n | N0n ransomware group spends $7K on AI tools, then leaves its own se...