Ransomware Tracker: N0N Group Leads 23 Leak-Site Claims in 24 Hours
Data desk analysis shows 23 unverified ransomware leak claims in a single day, with N0N accounting for more than half of the reported activity.
Key points
- N0N ransomware group claimed responsibility for 14 of the 23 leak-site posts recorded in a 24-hour period.
- The United States accounted for 10 of the claimed incidents, followed by Canada with two claims.
- Healthcare organizations were the most targeted sector, representing four of the 23 unverified claims.
Our data desk analysis of public information from the ransomware.live tracker reveals 23 ransomware leak-site claims within a 24-hour window. The N0N threat group was the most active actor, posting 14 claims, while other groups such as Qilin and Rhysida made fewer assertions. These claims are unverified statements made by criminal groups, and victim names are deliberately not reported.
At a glance
- Claims (24h)
- 23
- Active groups
- 7
- Most active
- N0N (14)
- Countries
- 6
The breakdown of claims by threat actor shows Qilin with three claims, Rhysida with two, and single claims from Emperador, BrainCipher, DragonForce, and IncRansom. The geographic distribution of these incidents places the United States as the most affected region with 10 claims. Canada followed with two claims, while Australia, Malta, Peru, and Colombia each reported one claim according to the tracker data.
Sector and Geographic Distribution
The healthcare sector faced the highest volume of claims, with four incidents reported during this period. Professional services and technology sectors each saw two claims, indicating a broad range of targets beyond critical infrastructure. Transportation and government and defense sectors each experienced one claim. This distribution suggests that ransomware groups continue to target diverse industries rather than focusing on a single vertical.
The concentration of claims in the United States aligns with historical trends of ransomware activity in North America. However, the presence of claims in other regions demonstrates the global nature of these cybercriminal operations. The data desk counted these claims based on public postings, meaning the actual number of successful intrusions may differ from the number of public assertions.
Understanding Leak-Site Claims
These leak-site claims represent unverified statements by criminal groups asserting they have stolen data or disrupted operations. The source material states that victim names are deliberately not reported. The ransomware.live tracker serves as the primary source for this count, providing a real-time view of public assertions.
Security professionals should treat these claims as indicators of potential compromise rather than confirmed breaches. The gap between a claim and a verified incident can be significant, as some groups may exaggerate their capabilities or target organizations that were not actually breached. Monitoring these sites helps identify trends in actor behavior and target selection.
What should you do?
Organizations should monitor threat intelligence feeds and leak-site aggregators for any mentions of their industry or geography. While specific victim names are not published, the high volume of claims indicates active campaigns. Security teams should review their own logs for signs of unauthorized access, particularly in healthcare and professional services sectors.
What to do and how to stay safe: N0N
- Monitor public ransomware leak sites and threat intelligence feeds for claims related to your industry or region to assess immediate risk levels.
- Review internal security logs for indicators of compromise, such as unusual file encryption activity or unauthorized administrative access attempts.
- Verify the integrity of critical data backups to ensure they are clean and can be restored quickly in the event of a ransomware attack.
- Ensure that incident response plans are up to date and that staff are trained to recognize and report suspicious activities promptly.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ransomware group was most active in the last 24 hours?
The N0N ransomware group was the most active, claiming responsibility for 14 of the 23 leak-site posts recorded.
How many ransomware leak-site claims were recorded in the 24-hour period?
A total of 23 ransomware leak-site claims were recorded by the data desk analysis of public data.
Which country had the most ransomware claims?
The United States had the most claims, with 10 incidents reported during the 24-hour tracking period.
