The N0n extortion group has published data it says it stole from VF Corporation, the Denver-based owner of Vans, The North Face and Timberland. According to QPulse, which tracks leak sites, the dump includes 121,198 customer chat sessions, 168,201 shopper messages and a directory of 176 VF employees. QPulse also says at least one chat log contains a shopper's Social Security Number and full date of birth in plain text. VF Corporation has not publicly confirmed the breach or commented on N0n's claims, and no regulator notice tied to this incident has been made public. Until then, the leaked data's details are the attacker's claims, reported by one tracking service.
What Happened
QPulse reports that N0n first posted the victim anonymously as "Company #141" on November 7, 2026, and gave the attack date as that same day. On November 14 the group named VF Corporation and published the data. The leak-site status reads "NOT PAID — EXPOSED", which suggests VF did not pay any ransom or did not negotiate.
VF filed a current report (Form 8-K) with the US Securities and Exchange Commission on October 28, 2026. That is before the date N0n gives for the attack, and nothing published so far links that filing to this incident.
Two other reports add context but should not be mixed up with this leak:
- The 2023 breach. WireWiz.blog says VF confirmed a breach that affected about 35 million customers, mostly Vans shoppers. Unauthorized access was detected on December 13, 2023, and disclosed to the SEC on December 15, 2023. That is a separate, earlier incident. Nothing indicates N0n was involved.
- ClimaxInc's claim. Undercode News, citing ThreatMon, reports that a different group, ClimaxInc, listed "FUTURA (VF DISTRIBUTION SAS)" as a victim on November 10, 2026. It is not clear whether that French company belongs to VF Corporation, and no evidence of stolen data has been published.
What Was Taken
QPulse lists the following, based on N0n's leak post:
- Customer service chats: 121,198 chat sessions and 168,201 individual shopper messages covering 23 weeks of 2026.
- AI assistant data: 332,292 assistant message records and 353,850 cached text passages from an AI search system (stored as "vector embeddings") used by 11 brand online stores. This points to a chatbot or AI shopping assistant as one likely source of the data.
- Employee records: names and email addresses for 176 VF staff.
- Sensitive personal data: at least one shopper's Social Security Number and full date of birth, typed into a support chat and stored in plain text.
No source has given a total size for the dump, and no one has said how many customers are affected. Nobody has independently checked these figures, and N0n's other claims have often been treated with caution. Fortra advises taking the group's threats "with a pinch of salt".
Why It Matters
Chat logs are a weak spot. Customers paste account numbers, addresses and sometimes government ID numbers into support chats. If transcripts are stored in full and then fed into AI search or training data, that sensitive information ends up in more places, and fewer people are watching it. The Social Security Number in VF's logs is a clear example.
The staff directory helps phishers. A verified list of 176 employee names and emails makes targeted phishing and impersonation of VF staff easier, especially if paired with a fake "data breach notice".
N0n is moving quickly. Proven Data reports N0n first posted victims on its Tor leak site on September 18, 2026. By November 9 it had claimed 215 victims in 38 countries, 193 of them in the previous 30 days. Accounts of the group's reach differ because they measure different things. Fortra counted about a dozen victims in the first days. SOCRadar's investigation, reported by The Register, documented attempts against 23 organizations in 14 countries. Proven Data's 215 counts claims on the leak site, not confirmed intrusions.
Retail and consumer brands are a growing share of N0n's targets. Cyber Daily reports N0n claimed more than one terabyte of Expedia data in a November 3 post, including loyalty program tables, and Expedia declined to comment. Fortra lists claims against Transcom, a customer support outsourcer for brands including PayPal. Neither claim has been confirmed.
It is not clear N0n is ransomware. Fortra notes that CyberXTron calls N0n "double extortion": it steals data and also threatens to encrypt files or destroy backups. SOCRadar describes the group as focusing on data theft and extortion without traditional ransomware. Proven Data says no encryption tool has been publicly linked to the group and that the public evidence better supports the data-theft view. The Register, however, reports that in some of SOCRadar's cases the attackers did encrypt files and deleted data and backups.
The Attack Technique
N0n has not said how it got into VF, and the company has not disclosed anything. How the group has broken in elsewhere is well documented, though, and it is consistent.
SOCRadar found an exposed server belonging to N0n and, as reported by The Register, concluded that "in every documented compromise in this investigation, access relied on weak or stolen credentials". SOCRadar found no evidence that N0n exploited any software vulnerability. Its methods included:
- Mass Remote Desktop (RDP) scanning to find exposed Windows remote-access services.
- Automated password-guessing against FortiGate SSL-VPN logins, using lists of stolen usernames and passwords. Against managed IT provider ChiBiTek, the group sent these attempts through a pool of home internet connections used as proxies (15 at a time) so they looked like ordinary users.
- Exposed cloud keys. In a case linked to Fanatics, an Amazon Web Services access key with read, list and delete rights let N0n copy data from 40 storage buckets, up to 110 GB each, and then delete data including bank-transaction archives.
- Reused hosting portal sessions.
- AI tools. The Register reports the operator spent more than $7,000 on AI services to help build its tools.
Fortra adds that the stolen credentials appear to come from infostealer malware. Once inside, the group moves around using legitimate admin tools and RDP rather than custom malware.
What Organizations Should Do
- Remove sensitive data from support chats and AI systems. Mask Social Security Numbers, payment card numbers and dates of birth before chat transcripts are stored, indexed or turned into embeddings. Set limits on how long chat logs and AI caches are kept.
- Lock down remote access. Require phishing-resistant multi-factor authentication on every VPN and RDP entry point. Take RDP off the public internet. Alert on bursts of failed FortiGate SSL-VPN logins from home internet addresses.
- Check for exposed cloud keys. Scan code repositories, build pipelines and storage for AWS access keys. Rotate long-lived keys, remove delete permissions wherever possible, and turn on S3 versioning and Object Lock so stolen keys cannot wipe data.
- Treat infostealer infections as stolen credentials. Watch infostealer log feeds for company domains. When an employee or contractor device is infected, reset every password and session token it held, not just the one that was noticed.
- Protect backups. Keep immutable or offline copies separate from the main login system, and test that you can restore from them. N0n's reported habit of deleting backups makes this essential.
- Warn VF staff and customers. Anyone in the leaked staff directory should expect targeted phishing. VF shoppers who used online chat support should watch for scam messages that cite real support conversations.
Sources: N0n Ransomware Group Exposes Data from VF Corporation Including Sho... | Exclusive: Cyber extortion group claims breach of Expedia, millions... | Crim spent $7K+ on AI services in extortion attacks, then left evid... | n0n Ransomware: What You Need to Know Fortra | VF Data Breach Hits 35M Vans Retail Customers Risk Guide - WireWiz.... | ClimaxInc Claims FUTURA (VF DISTRIBUTION SAS), While N0n Adds Landm... | N0n Ransomware: Data Extortion and Incident Response | October 28, 2026 - 8-K: Current report VF Corporation (VFC)