The newly emerged n0n (in lower case) extortion group is an emerging concern for Australian and New Zealand organisations, with claimed victims spanning healthcare and education and reported ransom demands reaching hundreds of millions of dollars.
n0n is a newly emerged data-theft extortion group first observed publicly listing victims in September 2026. While its nationality remains unknown, some threat intelligence vendors have assessed a possible Russian connection. However, no reliable public evidence has independently confirmed the group’s origins.
Unlike traditional ransomware operations that are primarily associated with encrypting victims’ systems, n0n’s observed activity appears focused on stealing sensitive information and threatening to publish it unless a ransom is paid. Its use of a Tor-based leak site, publication countdowns and public victim listings reflects a coercive extortion model designed to pressure organisations into negotiations.
Australia and New Zealand Victims
n0n has already been associated with claimed victims in both Australia and New Zealand, including organisations holding sensitive information.
| Country | Organisation | Sector | Reported activity |
|---|---|---|---|
| Australia | Hunter Neurology | Healthcare | n0n claimed to have obtained patient images, scans, clinical reports, laboratory results and practice backups. These claims were not independently verified at the time of reporting. |
| New Zealand | AHeadStart | Education / tutoring | Identified in September 2026 reporting as a New Zealand target associated with n0n. No public victim statement confirming a compromise had been identified. |
The potential exposure of medical records and operational backups is particularly concerning. If the group’s claims are accurate, the consequences could extend beyond reputational damage to include patient privacy impacts, regulatory scrutiny, operational disruption and prolonged recovery efforts.
These listings should be treated as unverified criminal claims, rather than confirmed breaches, unless independently substantiated.
Ransom Demands: Millions to Hundreds of Millions
There is currently no reliable, representative average ransom demand published specifically for n0n.
Public reporting on one reviewed maritime-sector campaign described demands ranging from approximately US$400,000 to US$400 million per victim. Another review of related listings found demands more commonly falling between US$2.4 million and US$14 million.
The significant variation makes it difficult to establish a typical demand or determine whether the largest figures reflect genuine negotiations, initial demands or unverified claims. The available figures are campaign-specific and should not be interpreted as representative of every n0n victim.
Some reporting has also described a payment-gated negotiation model involving an initial fee of around 10%. Organisations should independently validate such claims before treating them as established characteristics of the group.
Key Tactics, Techniques and Procedures (TTPs)
Public reporting on n0n remains limited, but its observed and reported behaviours indicate several techniques relevant to defenders.
| Technique / behaviour | Description |
|---|---|
| T1486 – Data Encrypted for Impact | Associated with data encryption for impact, although publicly available evidence does not establish that file encryption is central to n0n’s operations. |
| T1005 – Data from Local System | Associated with collecting data from local systems, relevant to potential information theft and subsequent extortion. |
| Data theft for extortion | Threatening to disclose stolen information to pressure victims into payment. |
| Leak-site deadlines | Using countdowns and threatened publication to create urgency during negotiations. |
| Public victim shaming | Naming organisations on Tor-based leak infrastructure to increase reputational pressure. |
| Bulk victim listings | Publishing multiple claimed victims across different sectors and countries. |
| Sensitive data targeting | Reported claims involving medical records, documents, images and backups. |
| Third-party targeting | Potentially exploiting service providers or connected organisations to reach downstream victims, although the extent of this activity remains unclear. |
| Valid credentials | A potential intrusion technique to investigate, but not a confirmed defining characteristic of every n0n incident. |
These behaviours should inform defensive monitoring, but organisations should distinguish techniques attributed to the group from activity that has been independently observed and confirmed.
Why n0n Matters to Australasian Organisations
n0n’s emergence highlights the continuing risk of data-extortion operations that can cause significant harm without requiring a proven, large-scale encryption event.
For Australian and New Zealand businesses, the principal concern is the potential theft of sensitive information followed by sustained pressure to pay. Organisations may face serious consequences even where systems remain operational, particularly when stolen information includes medical records, customer data, intellectual property or business-critical backups.
Organisations should prioritise:
- Identity security: Enforce phishing-resistant multifactor authentication where possible, investigate unusual sign-ins and restrict privileged access.
- Data protection: Apply least-privilege access, monitor unusual bulk downloads and review access to sensitive repositories and backups.
- Third-party assurance: Assess the security of service providers that hold or can access sensitive organisational information.
- Detection and response: Monitor for suspicious data staging, archive creation, large outbound transfers and unexpected access to backup infrastructure.
- Incident readiness: Ensure response plans cover data theft, extortion, privacy obligations and evidence preservation, not just file encryption.
- Recovery resilience: Maintain isolated, tested backups and rehearse recovery procedures.
Assessment
n0n should be treated as an emerging and potentially significant threat to Australasian organisations, particularly those holding sensitive personal, healthcare or commercial information. Its claimed activity in Australia and New Zealand, combined with the reported scale of some ransom demands, warrants continued monitoring.
However, the group’s short public history, uncertain origins and limited independently verified incident data mean its overall capability and regional impact remain difficult to assess. Claims about its nationality, intrusion methods, victim numbers and ransom demands should be treated cautiously until corroborated by reliable evidence.
For defenders, the practical priority is clear: strengthen identity controls, detect unauthorised data access and prepare for extortion scenarios in which stolen information—not necessarily encrypted systems—is the primary source of leverage.
