n0n
Data as of October 16, 2026.
Credential exposure before the attack
15.5% of n0n victims whose domain we can identify (9 of 58) had employee credentials leak in the 12 months before n0n named them as a victim.
We don't know whether any of these credentials were how n0n gained initial access.
What industries n0n targets
Sector identified for 46 of 58 victims.
| Logistics | 30 | |
| Healthcare | 5 | |
| Technology | 3 | |
| Manufacturing | 3 | |
| Financial Services | 2 | |
| Education | 1 | |
| Telecommunications | 1 | |
| Construction | 1 |
Where the victims are located
Country identified for 52 of 58 victims.
| South Korea | 11 | |
| United States | 10 | |
| Indonesia | 4 | |
| Brazil | 4 | |
| Japan | 3 | |
| United Kingdom | 2 | |
| Vietnam | 2 | |
| Singapore | 2 |
Most recent n0n victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Interior Technologies interior-technologies.com | Not identified | United States | Oct 15, 2026 |
| Trieschmann Dumala Architectural Group tdarchgroup.com | Not identified | United States | Oct 15, 2026 |
| Hunter Neurology hunterneurology.com.au | Healthcare | Australia | Oct 14, 2026 |
| MarieBelle New York mariebelle.com | Not identified | United States | Oct 14, 2026 |
| Pure Options pureoptions.com | Healthcare | United States | Oct 14, 2026 |
| Apical Group apicalgroup.com | Not identified | Singapore | Oct 13, 2026 |
| April Group aprilasia.com | Manufacturing | Indonesia | Oct 13, 2026 |
| Asyaport Liman asyaport.com | Logistics | Turkey | Oct 13, 2026 |
| Bukit Kayu Hitam ICD bkhicd.com | Logistics | Malaysia | Oct 13, 2026 |
| Basra Multi-Purpose Terminal bmtiq.com | Logistics | Not identified | Oct 13, 2026 |
| Camellia Line camellia-line.co.jp | Logistics | Japan | Oct 13, 2026 |
| CULines culines.com | Logistics | China | Oct 13, 2026 |
| Dong-A Tanker dongatanker.com | Logistics | South Korea | Oct 13, 2026 |
| Dongkuk dongkuk.com | Manufacturing | South Korea | Oct 13, 2026 |
| Eurogate Tanger eurogate-tanger.com | Logistics | Not identified | Oct 13, 2026 |
| Eusu Logistics eusu-logistics.com | Logistics | South Korea | Oct 13, 2026 |
| Global Clearinghouse Systems gcskw.com | Logistics | Not identified | Oct 13, 2026 |
| GlobalNet globalnetlcl.com | Logistics | Indonesia | Oct 13, 2026 |
| Global NC gncnet.co.kr | Logistics | South Korea | Oct 13, 2026 |
| HPC Hamburg Port Consulting hpc-hamburg.de | Logistics | Germany | Oct 13, 2026 |
Showing the 20 most recent of 58. Browse recent data breaches for more.
n0n leak site
The address we've seen n0n publish victims from. Any .onion address needs the Tor Browser.
nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion
n0n questions
Is n0n still active?
Yes. n0n posted its most recent victim on October 15, 2026. That's 58 victims in the last 30 days.
How many victims has n0n claimed?
n0n has named 58 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did n0n first appear?
The first victim we recorded for n0n was posted on September 21, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does n0n target?
Logistics accounts for the most victims we can classify, with 30. Healthcare follows at 5. We could identify a sector for 46 of 58 victims, so treat this as the shape of the targeting rather than a full census.
Has n0n already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.