On November 7, 2026, the N0n extortion group added "Staples, Inc. / SBD Inc." to its dark web leak site. It says it stole shopper activity logs, customer chat transcripts, a staff directory and a small table of Social Security numbers. Staples has not confirmed the incident or commented publicly, and no regulator filing or breach notification has been published. Every detail below comes from the attackers' own listing, as reported by threat-intelligence trackers. None of it has been checked independently. Reports put the exposed staff directory at "nearly 200" (QPulse) to 200 (HIFY Radar) employees, and both describe 30 Social Security numbers in the listing.
What Happened
ThreatMon flagged the N0n listing on November 7, according to Undercode News. QPulse reports that the leak-site entry appeared at 10:54 UTC that day, gives the same day as the estimated attack date, and says the data is marked "NOT PAID — EXPOSED." That label suggests the group says it has already published the data after Staples did not pay.
Accounts differ on what was hit. QPulse and Undercode News name the victim as "Staples, Inc. / SBD Inc.", the label on the leak site. HIFY Radar narrows it to Staples Business Advantage, the company's corporate contract and purchasing platform. HIFY bases that on a single post on X by the researcher AlvieriD. No public reporting explains what "SBD Inc." refers to or how it relates to Staples.
This listing is separate from the earlier Staples gift-card fraud case. In October 2026, 404 Media used details in an unsealed court filing to identify Staples as the unnamed retailer in that case, and Gizmodo, Yahoo News and TechSpot carried the story. According to the filing, attackers reached an internal customer-support application called Nexus from outside the network and used it to issue more than 15,000 gift cards worth over $5 million. Investigators linked the scheme to a Chinese organised crime ring. Homeland Security Investigations was first told of that breach in October 2023. Nothing in the public record connects it to N0n.
What Was Taken
N0n claims the following, according to QPulse's description of the listing:
- Commercial data: a single daily file of 381,964 records with per-product profit margins, plus unit sales and revenue figures for 64,041 products.
- Shopper activity logs: IP addresses, search terms and device information.
- Shopper chat transcripts: including callback phone numbers. HIFY Radar describes these as purchasing chat logs.
- Staff directory: names and email addresses for "nearly 200" employees (QPulse) or 200 employees (HIFY Radar).
- Social Security numbers: a table of 30 SSNs with dates of birth, per QPulse. HIFY Radar describes these as customer SSNs. QPulse does not say whose they are.
The SSN count is small, but those records carry the most identity-theft risk. The product margin data matters more to Staples commercially, because competitors and contract customers would value it.
Why It Matters
N0n is new. Fortra reports that it was first seen in mid-September 2026 and listed about a dozen claimed victims within days. Those victims include customer-support outsourcer Transcom and Venezuelan ISP Inter. Fortra notes that the group's claims about destroying networks and backups "should perhaps be treated with a pinch of salt." Researchers also disagree on what kind of group this is. CyberXTron calls its approach double extortion. SOCRadar says it focuses on data theft and extortion without traditional encryption. Nobody has reported Staples systems being encrypted or knocked offline.
If the listing is genuine, the most direct risk is targeted phishing. Staff names and email addresses support business email compromise, and chat transcripts with callback numbers let criminals pose convincingly as Staples support to real customers. For Business Advantage clients, purchasing chat logs could reveal procurement contacts and buying patterns. Gift-card fraud has already exploited Staples' support tooling once, so its customer-service systems remain a known target.
The Attack Technique
N0n has not said how it got in, and HIFY Radar reports no technical detail beyond the leaked samples. Fortra's profile of earlier N0n intrusions describes logins using valid credentials stolen by infostealer malware, followed by movement across the network with legitimate admin tools and RDP. Fortra found no sign the group relies on unpatched software vulnerabilities. Whether that pattern applies here is unknown.
What Organizations Should Do
- Business Advantage customers: ask your Staples account team in writing whether your organisation's data is in scope. Warn procurement staff to expect phishing that references real orders or chats.
- Check for infostealer exposure: check stolen-credential feeds for your corporate domains. Reset any exposed passwords and revoke active sessions, especially for SSO, VPN and support-platform accounts.
- Lock down remote access: require phishing-resistant MFA on RDP, VPN and admin tools. Alert on admin tools used from unusual hosts or at unusual times.
- Audit customer-support platforms: confirm that internal support tools cannot be reached from the internet. Restrict debug endpoints such as heap dumps, and log bulk exports of chat and activity data.
- Find and minimise stored SSNs: locate SSNs held in operational databases and remove or tokenise any that are not strictly needed.
- Prepare to notify: if your data appears in the leak, line up credit monitoring for affected people and review state breach-notification deadlines.
Sources: N0n Ransomware Group Claims Data Exfiltration from Staples, Inc. /... | n0n group alleges breach of Staples Business… HIFY Radar | N0n Ransomware Group Claims Staples, Inc and SBD Inc as New Victims... | Chinese Crime Ring Allegedly Hacked Staples to Mint $5 Million in G... | Staples: Grupo n0n alega invasão e vazamento… HIFY Radar | Authorities link Staples gift-card breach to Chinese crime ring and... | Staples hackers created more than 15,000 gift cards, then went on a... | n0n Ransomware: What You Need to Know Fortra