Hunter Neurology Data Breach

N0n ransomware has claimed Hunter Neurology, an Australia-based specialist medical practice in the Healthcare sector, on its leak site. The claim was made on October 13, 2026, with SOCRadar CTI analysis pointing to Horizon Cloud VDI credential exposure as a significant indicator of initial access. This incident marks N0n’s fourth victim reported in this cycle and is notable for the temporally close stealer-log exposure, with credentials dated October 12, 2026, just one day prior to the ransomware announcement. N0n is known for pursuing double-extortion campaigns and has been observed targeting backup infrastructure to disrupt recovery operations. The group has targeted organizations in the healthcare, financial services, and retail sectors across North America and Asia-Pacific throughout 2026. The claim against Hunter Neurology aligns with N0n’s pattern of targeting Australian healthcare organizations, reinforcing their operational focus within this sector and region.

SOCRadar flagged the domain hunterneurology[.]com.au in stealer-log data sampled prior to the ransomware claim. The retrieved credentials specifically targeted VMware Horizon Cloud virtual desktop infrastructure, identified via the following endpoints: – auss1.horizoncloud[.]com.au — Horizon Cloud VDI endpoint – ss1.horizoncloud[.]com.au — Horizon Cloud VDI endpoint The most recent relevant record was dated October 12, 2026, precisely one day before N0n’s public claim of Hunter Neurology. VDI credentials can bypass many perimeter security controls by providing direct, authenticated access into enterprise environments. The one-day temporal gap between the credential records found in criminal markets and the ransomware group’s publication represents the tightest observed in this reporting cycle. While direct attribution of the initial access method to N0n remains unconfirmed, the evidence profile strongly suggests a connection between the exposed VDI credentials and the subsequent ransomware claim. This situation presents a high-urgency indicator for Australian healthcare organizations utilizing VMware Horizon Cloud or similar VDI solutions. The rapid succession from credential exposure to a ransomware claim signifies an active threat timeline. Organizations, particularly those in the healthcare sector, must promptly assess the scope of any potential data access and comply with patient data protection obligations under Australian privacy laws. The immediate next steps should include enforcing certificate-based or phishing-resistant multi-factor authentication (MFA) on all VDI and remote access sessions, reviewing VMware Horizon access logs for unauthorized activity between October 10-13, 2026, and engaging breach counsel to understand notification obligations.