Key points
- N0N filed 14 unverified leak-site claims in a 24-hour period, the highest count among all groups.
- Ten of the 23 total claims involved targets located in the United States.
- The healthcare sector was the most targeted industry, with four claims recorded.
Organizations must verify ransomware leak-site claims because criminal groups often post unverified statements to create panic. Our data desk analysis of public data shows that 23 such claims appeared on leak sites within a single 24-hour window. The N0N group was the most active actor, responsible for 14 of these entries. These claims are unverified statements by criminal groups, and victim names are deliberately not reported to protect privacy.
In plain English
Ransomware groups use leak sites to threaten victims with data exposure if they do not pay ransoms. A claim is simply a statement posted by the group saying they have attacked a specific organization. It does not prove that data was actually stolen or that the group controls the victim’s systems. Our tracking shows that N0N posted 14 claims in one day. Other groups also posted claims: qilin posted three, rhysida posted two, and emperador, BrainCipher, dragonforce, and incransom each posted one.
The background
The geographic distribution of these claims shows a heavy concentration in North America. According to our data desk, ten of the 23 claims involved targets in the United States. Two claims involved targets in Canada, and one each involved targets in Australia, Morocco, Peru, and Colombia. The sector breakdown reveals that healthcare organizations were the most frequent targets, with four claims. Professional services and technology sectors each had two claims, while transportation and government and defense sectors each had one claim.
What changes now
Business leaders should treat leak-site claims as initial alerts rather than confirmed breaches. The high volume of claims from N0N suggests increased operational tempo by that specific group. Organizations in the United States and the healthcare sector should review their external communications and security monitoring. Since victim names are not reported, companies must actively check leak sites to see if they are listed. The unverified nature of these claims means that further investigation is required before assuming a breach has occurred.
Background: Ransomware
Ransomware enters through weak entry points, moves laterally using stolen credentials, and encrypts files using asymmetric cryptography. You can interrupt the cycle by isolating network segments, enforcing least privilege, and maintaining offline backups that attackers cannot reach.
Read the full guide: How Ransomware Works: The Step-by-Step Infection Cycle
What to do and how to stay safe: N0N
- Monitor known ransomware leak sites daily for new claims involving your organization or industry sector.
- Verify any claim by checking internal security logs for signs of unauthorized access or data exfiltration.
- Ensure your incident response plan includes steps for validating external threat intelligence and leak-site posts.
- Review access controls and backup integrity to reduce the impact of potential ransomware attacks.
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many ransomware leak-site claims were recorded in the last 24 hours?
Our data desk analysis found 23 unverified ransomware leak-site claims in a 24-hour period.
Which ransomware group was the most active during this period?
The N0N group was the most active, filing 14 of the 23 total claims recorded.
Which country had the most targets in these claims?
The United States had the most targets, with ten of the 23 claims involving US-based organizations.
