159 Solutions, Inc. Data Breach

The N0n extortion group has listed 159 Solutions, Inc., a United States-based organization, as a victim on November 9, 2026, with the claim observed through SOCRadar’s dark web monitoring. The incident currently stands as an alleged compromise rather than an independently confirmed breach, and the available reporting does not specify the company’s industry. The context of the listing is significant in itself: because N0n operates an extortion-only model, 159 Solutions may not have experienced any obvious operational disruption, which is precisely the risk. With no encryption event or visible outage to prompt an internal investigation, an extortion claim of this kind can be the first external sign that a compromise has occurred. N0n is a data-theft extortion group that does not use ransomware encryption, relying instead on exfiltration and threatened publication to pressure victims. This approach trades operational disruption for stealth: victims may not realize they have been compromised until N0n posts the name. The group targets broadly across sectors and geographies, mixing named victims with anonymized “Company #XXX” listings to demonstrate the breadth of its claimed compromises. The claim against 159 Solutions fits this pattern, with a named United States-based victim consistent with the group’s sector-agnostic, geographically broad targeting rather than a narrow focus on any single industry or region.

SOCRadar’s monitoring found no stealer activity for 159 Solutions’ infrastructure. The query covered the stealer-log telemetry collected through SOCRadar’s dark web monitoring, and no records correlating infostealer-harvested credentials to the company’s environment surfaced in connection with this listing. This result does not confirm that the organization is unaffected. An empty stealer-log finding reflects the coverage of the datasets queried rather than proof that no compromise occurred: credentials tied to 159 Solutions may exist under alternate corporate domains or personal email aliases, may reside in feeds outside the queried dataset, or may not yet have been indexed at the time of review. N0n’s initial access methods span exploitation of publicly accessible services, targeted phishing, and leveraging access from underground initial access brokers. Any of these paths could plausibly underpin the claim against 159 Solutions, although the source of the group’s access in this case has not been confirmed. The extortion-only model adds a distinctive detection problem: compromise can sit undetected for weeks before the public listing forces the issue. The recommended actions for an incident of this type center on response and reporting. The scope of any unauthorized access should be investigated, including which data categories may have been exfiltrated. Legal counsel should be engaged to address state breach notification obligations and applicable federal regulations. The extortion attempt should also be reported to the FBI’s Internet Crime Complaint Center (IC3), as N0n’s activities are under active law enforcement monitoring.