LiveRamp Data Breach

LiveRamp, the U.S.-based data connectivity and identity resolution platform, appeared on N0n ransomware’s leak portal on November 11, 2026, with the listing surfaced through SOCRadar’s Dark Web Monitoring service. The claim is unconfirmed. LiveRamp sits at the intersection of enterprise marketing data and large-scale identity infrastructure: it enables brands, agencies, and publishers to move data across ecosystems with privacy-compliant identity resolution. That position makes the company a valuable target for ransomware actors — not just for the data it holds, but for the downstream reach that access to its environment could enable. N0n is not selective. The group claimed roughly 270 victims in the 60 days preceding this listing, with heavy concentration in Transportation and Technology, and the United States, Canada, and South Korea dominate its victim geography. Recent N0n listings alongside LiveRamp include DraftKings (US, Retail & E-Commerce), Infutor Data Solutions (US, Technology), Chartboost LLC (US, Technology), and Scry Analytics (US, Technology) — a consistent pattern of U.S. data and analytics companies. LiveRamp fits squarely within this pattern, combining a U.S. base with a technology- and data-centric business model.

SOCRadar’s stealer-log query against LiveRamp returned no records. The query examined stealer-log telemetry for credential material associated with the company and found no direct correlation. Although a null result may appear reassuring at first glance, it is not a clean bill of health: the absence of matching records does not confirm that the organization is unaffected, and it should not be interpreted as evidence that no compromise occurred. Technology companies of LiveRamp’s scale use SSO federations, cloud identity providers, and multiple authentication domains — any of which could appear under a different domain in stealer logs. Credentials may also have surfaced after the query window closed, or through personal email aliases not tied to the corporate domain. For these reasons, exposed credentials could exist without appearing in the queried dataset, and the null result does not rule out credential exposure connected to LiveRamp. Regardless of the null result, continued monitoring and proactive credential hygiene are warranted. Defenders should maintain dark web and stealer-log monitoring for credential material tied to LiveRamp’s corporate domains or to personal aliases used by its workforce, and apply proactive credential-hygiene checks so that any credentials that surface can be identified and addressed promptly. These measures address the residual uncertainty left by the null stealer-log finding while the N0n claim remains unconfirmed.