The N0n extortion group has published data it says it stole from Steeden Financial Group, a Canadian financial planning and insurance practice. Threat intelligence outlet QPulse reports that the leak includes a client database with more than 600,000 distinct email addresses, taken from two separate backups. QPulse also reports client record notes that name clients and their family members, along with their Social Insurance Numbers (SINs). All of the detail on the leak so far comes from QPulse's monitoring of N0n's leak site. Steeden Financial has not commented publicly. No Canadian privacy regulator filing or breach notice to clients has been published, and no established security outlet has independently checked the data.
What Happened
QPulse's timeline runs as follows:
- November 7, 2026: N0n listed the victim anonymously on its leak site under two labels, "Company #140" and "Company #187". QPulse gives the same date as its estimate of when the attack happened.
- November 14, 2026: N0n named Steeden Financial Group and published the data. QPulse logged the post at 22:05 UTC.
- Current status: The leak site marks the listing "Not paid, exposed". This suggests the ransom was not paid and the group has released what it holds.
N0n used two anonymous labels for one victim. That may simply be because the data came from two backups. It could also mean two separate break-ins or two separate sets of data. Without a statement from the company, it is not possible to say which.
Steeden Financial appears to be a small advisory practice. LinkedIn profiles show it based in Edmonton, Alberta, with advisers who have worked in financial planning, insurance and estate planning, including time at Sun Life. Because the firm is small, the reported volume of records stands out. More than 600,000 email addresses is far more than a practice of this size would normally serve as clients. The data may include old clients, prospects, family members, records held for partner insurers, or duplicates across the two backups. None of this has been confirmed.
What Was Taken
QPulse's description of the leaked data, which has not been confirmed:
- Client database: more than 600,000 distinct email addresses, recovered from two backups.
- Client record notes: adviser notes that identify clients and their family members.
- Social Insurance Numbers: the most damaging item. A SIN is Canada's main identifier for tax, benefits and credit. It is hard to change and very useful for identity fraud.
About the figure: only one report gives a number, and it counts distinct email addresses, not people. The real number of individuals affected could be lower, because people often have more than one address and the backups overlap. It could also be higher, because family members named in notes may have no email address on file. No other outlet, the company or any regulator has given a count.
Financial planning notes often hold more than identity data: income, assets, beneficiaries, health details for insurance underwriting, and estate plans. If those notes are in the leak, a SIN combined with that financial background gives criminals what they need for convincing fraud and social engineering.
Why It Matters
Small firms hold large, sensitive datasets. Steeden fits a pattern seen across financial services this year. American Banker reports that a breach at Mercadien, a New Jersey auditing firm, reached customers of at least nine banks and credit unions. Some of those institutions had stopped working with Mercadien years earlier, yet their customers' data was still on its systems. Mercadien reported about 402,700 affected people, and the Indiana Attorney General's filing shows a gap of up to 10 months between detection and some notification letters. Professional service firms tend to keep client data long after they need it, and attackers know this.
Backups are a target in their own right. QPulse says the data came from two backups. Backups are often less protected than live systems: weaker access controls, no encryption, and less monitoring. They also tend to hold years of records in one place.
Refusing to pay means the data gets published. The "not paid" status matches what happened to Berlin's Senate administration. heise reports that when Berlin refused Rhysida's demand of 30 bitcoin, more than 5 terabytes of its data was posted publicly. Not paying is the right policy, but organisations need to plan for full public exposure of whatever was taken.
Notification is a legal duty in Canada. Under PIPEDA, and Alberta's PIPA for an Alberta-based firm, organisations must report breaches that pose a real risk of significant harm. Leaked SINs almost certainly meet that test.
The Attack Technique
How N0n got in has not been disclosed. The company has not explained it and no forensic report has been published. The only technical detail available is that the data came from backups, which suggests the attackers reached backup storage or backup files. That could have been through a compromised file server, a cloud storage account or a backup service, but this is guesswork.
Recent attacks on financial organisations show the methods that are common right now, though none have been linked to N0n or Steeden:
- Exploiting internet-facing servers. Kaspersky's Securelist has analysed Storm-2603's use of the ToolShell flaws in on-premises SharePoint (CVE-2025-53770 and CVE-2025-53771). The attackers ran their tools entirely in memory inside the IIS worker process, then tried to disable endpoint security and deploy ransomware.
- Automated attack tooling. Security Affairs, citing Hunt.io, CrowdStrike and Genians, reports that ARTEX, an open-source AI penetration testing framework, was used to breach seven South Korean financial institutions through internet-facing systems.
- Account abuse. Seoul Economic Daily reports that Korea's Financial Security Institute was breached by an attacker who logged in with a forged or altered administrator account ID.
- Tricking users. heise reports that Rhysida got into Berlin's network with fake CAPTCHA pages that persuade victims to paste and run PowerShell commands.
What Organizations Should Do
- Lock down and encrypt backups. Keep backups on separate credentials and, where possible, separate networks. Encrypt them at rest and alert on unusual access or bulk reads. Use immutable or offline copies.
- Delete data you no longer need. Set retention limits for former clients, prospects and closed files, and enforce them. The Mercadien case shows what happens when records outlive the client relationship.
- Keep SINs separate. Store Social Insurance Numbers in a separate, encrypted field with tight access rules, and keep them out of free-text adviser notes where controls can't reach them.
- Patch and watch internet-facing systems. Prioritise remote access, file sharing and collaboration servers such as on-premises SharePoint. Look for in-memory implants as well as files written to disk.
- Require MFA on admin accounts and monitor them. Use phishing-resistant MFA for administrator and backup accounts, and alert on new admin logins or changes to account IDs.
- Prepare for publication and notification. If you decide not to pay, assume the data will go public. Have a plan ready to identify affected clients, report to regulators such as the Office of the Privacy Commissioner of Canada, and offer credit monitoring and SIN fraud guidance quickly.
For Steeden Financial clients: until the firm issues a notice, treat calls and emails that mention your financial plan or insurance as possible fraud. Place a fraud alert with Equifax Canada and TransUnion Canada, and watch your Canada Revenue Agency and Service Canada accounts for changes.
Sources: N0n Ransomware Group Exposes 600,000+ Records from Steeden Financia... | How to detect fileless attacks exploiting ToolShell: analyzing the... | Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Ba... | Berlin’s massive data leak: How to dissect it heise online | Auditor's breach hit at least 9 banks, credit unions American Banker | Luke Steeden, BBA, CHS | Mercadien Data Breach Alert (2026) | Korea's Financial Security Institute Hacked, Data Leaked - Seoul Ec...