PG Group (Pure Options) Data Breach

N0n ransomware has claimed PG Group, which operates as Pure Options, a US-based cannabis retailer, on its leak site, with the listing dated October 13, 2026. SOCRadar’s analysis of this incident highlights significant stealer-log exposure, posing a risk of customer account takeover (ATO). The cannabis retail sector, while niche, can be attractive to ransomware groups due to its often cash-intensive nature and the potential for disruption impacting a supply chain and customer base. The specific victim’s storefront and delivery portals suggest a focus on customer-facing data. This claim by N0n falls within the broader context of the group’s activity, which has been observed to target backup infrastructure to hinder recovery efforts. In 2026, N0n has demonstrated a consistent victim rate across North America, impacting sectors such as healthcare, financial services, and retail. PG Group’s inclusion aligns with the ransomware group’s pattern of targeting the retail industry.

SOCRadar’s threat intelligence platform detected the domain pureoptions[.]com within stealer-log data sampled prior to the ransomware claim. This query returned 25 credentials. The identified exposure window spans from November 2025 to September 30, 2026, indicating a 13-month period of accumulating credential exposure. The analysis revealed that all usernames found were associated with consumer email providers (Gmail, Yahoo, ProtonMail) or were numeric identifiers. This pattern is consistent with customer storefronts and delivery portals rather than employee or administrative accounts. Furthermore, the sampled data included a WordPress administrative login page (pureoptions[.]com/wp-login.php), suggesting a potential avenue for compromise through the Content Management System (CMS). While no direct employee or administrative credentials matching high-privilege systems were identified in the returned sample, the 13 months of sustained customer credential exposure, coupled with the presence of a visible WordPress admin interface in criminal markets, indicates that the customer-facing platform has been a consistent target for data harvesting. The presence of customer credentials in stealer-log data, along with a visible WordPress administrative login page, suggests a potential pathway for attackers to gain access to the organization’s systems. While this does not confirm that this specific access method was utilized for the ransomware attack, it indicates a significant risk of account takeover and potential lateral movement within the compromised environment. This sustained exposure of customer data in underground markets elevates the risk profile for both the organization and its customers.