MarieBelle New York Data Breach

N0n ransomware has claimed MarieBelle New York, a luxury chocolate brand, on its leak site on October 13, 2026. This marks the group’s third victim in the United States within the current reporting cycle. SOCRadar’s investigation, which included a stealer-log query for the domain mariebelle[.]com, returned a limited set of records, indicating a positive signal regarding potential credential exposure. While the volume of identified credentials is low, the presence of associated records warrants attention, especially considering the nature of MarieBelle New York’s business as an e-commerce platform handling customer orders and payment information. N0n has demonstrated consistent operations across North America during the third and fourth quarters of 2026, frequently targeting retail, financial services, and healthcare organizations. The group is known for employing double-extortion tactics and has been observed targeting backup infrastructure to amplify disruption. This incident, involving a US-based retail organization, aligns with N0n’s typical targeting patterns, as they continue to pursue high-value data and leverage various access vectors for their campaigns.

SOCRadar queried the domain mariebelle[.]com in criminal market sources prior to the N0n claim. The query identified a limited number of credentials associated with the domain. These records were classified as follows: consumer account credentials, representing the majority of returned records and linked to customer accounts on the mariebelle[.]com e-commerce platform; and two records classified as third-party/supplier-category credentials. The volume of identified credentials is low when assessed against high-risk case standards. It is important to note that collection gaps in available stealer-log sources mean the true scope of credential exposure may exceed the returned sample. The records retrieved represent what surfaced within the query window and not a comprehensive inventory. The presence of supplier-category credentials is of particular concern, as third-party access paths are a known initial access vector for ransomware intrusions. Any positive stealer-log result for an organization subsequently claimed by ransomware should be treated as a potential initial access indicator, even if the volume is low. MarieBelle New York operates a customer-facing e-commerce platform, a sector that stores high-average-value order data and customer payment credentials. Key areas for forensic review include the e-commerce platform logs for unauthorized administrative access, auditing the two supplier/third-party credential records to determine any systems access they may have facilitated, and assessing whether payment processor integrations were compromised. Customers should consider their account credentials potentially compromised and monitor for unauthorized orders or payment activity.