Company #111 Data Breach

On October 27, 2026, the N0n ransomware group added an entry designated only as “Company #111” to its dark-web leak site, identified through SOCRadar’s dark-web monitoring data. The targeted organization is reported as based in the United Arab Emirates, but its specific identity, industry vertical, and operational scope remain undisclosed in N0n’s public listing. The anonymized designation reflects the group’s practice of withholding victim names during active extortion negotiations to preserve leverage, which currently prevents independent verification of the victim’s profile or the claimed compromise. The UAE location is nonetheless significant: the country hosts a high concentration of energy, finance, logistics, and government-linked entities where data sensitivity and operational continuity requirements drive payment probability, making organizations in the region attractive ransomware targets. N0n has listed 149 victims in the past 60 days, a high operational tempo among tracked ransomware operators. Its targeting skews toward the United States, South Korea, and Brazil, though its global reach is established, and its most frequently hit sectors are Transportation, Manufacturing, and Healthcare — a pattern consistent with a preference for organizations with time-sensitive operations and low tolerance for extended downtime. The current victim departs geographically from the group’s leading victim countries, as the organization is UAE-based, but N0n’s established global reach accommodates targets outside its core geography. Because the industry vertical remains undisclosed, it cannot yet be determined whether Company #111 fits the group’s typical sector profile.

No domain is associated with this listing, so SOCRadar’s infostealer pipeline had no domain to query. As a result, no stealer-log records could be checked and no credential-level correlation could be performed for Company #111. This should not be interpreted as a clean result: the absence of any telemetry finding does not confirm that the organization is unaffected, and no conclusion about the victim’s credential exposure can be drawn from this empty result. SOCRadar assesses that the missing domain is consistent with N0n’s practice of withholding victim details during active negotiations — a pressure tactic rather than a signal of a low-value target. Until the victim’s identity and corporate domain are disclosed, technical corroboration of the claim is not possible, and no intrusion path behind the listing can be assessed from public data. The regional context reinforces the significance of this listing. The UAE’s concentration of energy, finance, logistics, and government-linked entities, where data sensitivity and operational continuity requirements drive payment probability, makes the country an attractive ransomware environment, and N0n’s current operational tempo indicates an active, sustained campaign rather than sporadic activity. Gulf-region organizations should treat the group as an active threat, not a distant risk. SOCRadar’s recommended next steps are to initiate dark-web monitoring, credential hygiene audits, and EDR telemetry review. Continued leak-site tracking is particularly relevant in this case, as SOCRadar will update this entry as additional details about the victim’s identity or the breach scope become available; once a corporate domain is disclosed, stealer-log correlation and credential-exposure checks can be performed against the listing.