# N0n Ransomware Group Lists US Fintech Firm Finzly Corp on Leak Site - URL: https://usa-24.com/n0n-ransomware-group-finzly-corp/ - Publisher: USA 24 - Section: Cybersecurity - Published: 2026-10-19T20:01:27.491Z - Updated: 2026-10-19T20:01:27.499Z - Topics: Ransomware, N0n Ransomware Group, Data Breach, Infostealer Malware, Fintech Security > The N0n ransomware group has posted US fintech firm Finzly Corp to its leak site, claiming it took cloud access keys. Finzly has not confirmed any intrusion. ## Key takeaways - The N0n ransomware group posted US fintech payments firm Finzly Corp to its leak site on October 19, 2026, claiming it took payment-infrastructure access secrets and cloud access keys. - Finzly has not confirmed an intrusion, and no regulatory filing or breach notice from the company turned up in the reporting. - N0n relies on credentials stolen by infostealer malware and threatens to publish data instead of encrypting victims' systems. - SOCRadar counts 82 N0n victims in one tracker, averaging about 41 a month, and lists 97.5 percent as claimed by the group. - On October 19, eight of 18 new ransomware postings across seven groups were attributed to N0n. A ransomware crew calling itself N0n posted US fintech payments firm Finzly Corp to its leak site on October 19, 2026, claiming it had taken network configuration details, payment-infrastructure access secrets and cloud access keys. Finzly has not confirmed an intrusion, and I found no regulatory filing or breach notice that does. The N0n ransomware group is still adding victims, so this story is about scale and pattern, not confirmed breach totals. ## What the Finzly leak listing claims The listing first appeared at 01:23 UTC on October 19, according to [Ransomware.live](https://www.ransomware.live/id/Rmluemx5IENvcnBATjBu). [Hookphish](https://www.hookphish.com/blog/ransomware-group-n0n-hits-finzly-corp/) lists the company the same way, as a US fintech payments firm, and [Quasar Cyber Tech's QPulse](https://qpulse.quasarcybertech.com/news/7017/n0n-ransomware-group-claims-breach-of-finzly-corp-exposing-payment-infrastructure-credentials) frames the claim as exposure of payment-infrastructure credentials. The entry says the group took four kinds of material: network configuration details, payment-infrastructure access secrets, cloud environment topology and cloud access keys. It labels the data "NOT PAID — EXPOSED," a status the group assigns itself. The trackers I reviewed, including [DeXpose](https://www.dexpose.io/n0n-ransomware-group-attacks-fintech-leader-finzly-corp/), rely on that leak-site text rather than independent evidence. Why this listing matters comes down to what the group says it holds. Payments firms sit between banks, merchants and consumers. If the claim holds, a stolen key that opens payment infrastructure could be a route to fraud, and any customer or partner integrated with that system could face unauthorized access risk. Cloud topology would also give an intruder a map of where to go next. ## Why the N0n ransomware group skips encryption [SOCRadar's group profile](https://socradar.io/free-tools/ransomware-intelligence/groups/n0n) describes N0n as a financially motivated extortion crew that first appeared in September 2026. It relies on stolen credentials from infostealer malware and pressures victims by publishing data rather than encrypting their systems. That is a different playbook from the lock-and-demand model most readers picture when they hear the word ransomware. The threat is exposure, not downtime, and exposure can pressure a company even when its own systems keep running. The same profile says 97.5 percent of N0n victims are listed as "claimed" by the group, and 1.2 percent are marked as data leaked. Those are the tracker's labels, not verified breach outcomes. The tracker also counts 82 total victims, averaging about 41 a month. Because those numbers come from one aggregator, read them as a rough measure of pace rather than an audited count. The victims so far are concentrated in US firms. For American companies, that makes the group's pattern more than a foreign problem with a domestic spillover. ## The other US companies on N0n's recent list Finzly is not the only name. Trackers have logged several recent US victims, and the sample below shows how the claims differ. | Victim | Location | Listing date | What the listing claims | |---|---|---|---| | Finzly Corp | US fintech payments firm | October 19, 2026 | Network configuration details, payment-infrastructure access secrets, cloud topology and cloud access keys | | SQA Services Inc. | Software quality assurance, California | October 18, 2026 | VPN credentials for 64 employee accounts, domain controller configuration details | | SMIC US Company | Sunnyvale, California | October 18, 2026 | Corporate files, payroll records and financial documents | SQA Services is the clearest example of the access problem. [Kalir Pulse](https://pulse.kalir.io/en/ransomware/n0n/603dcf87f9) and [Hookphish](https://www.hookphish.com/blog/ransomware-group-n0n-hits-sqa-services-inc/) both report the claim. VPN logins combined with domain controller details are the kind of pairing that could let an intruder move from one employee's remote session toward the core of a corporate network. If the claim is accurate, 64 accounts is a wide surface. The SMIC listing says corporate files, payroll records and financial documents were posted. [Ransomware.live](https://www.ransomware.live/id/U01JQyBVUyBDb21wYW55IChTdW5ueXZhbGUsIENBIOKAlCBVUyBhcm0gb2YgU2VtaWNvbmR1Y3RvciBNYW51ZmFjdHVyaW5nIEludGVybmF0aW9uYWwgQ29ycG8uLi5ATjBu) logged it. Payroll records can include employee names, addresses and bank details, so staff at any firm named in a listing should expect phishing that uses real personal information. Other recent listings include a Texas managed IT services firm, labeled Company #80, and a US IT services firm, labeled Company #85. [Hookphish](https://www.hookphish.com/blog/ransomware-group-n0n-hits-company-80/) covers the first, and a [separate Hookphish post](https://www.hookphish.com/blog/ransomware-group-n0n-hits-company-85/) covers the second. Unnamed listings are hard for customers to check, and an IT provider's clients could face downstream risk if stolen VPN or admin credentials were used. The sector spread runs from financial services to IT services and manufacturing, according to the trackers that flagged these victims. A [daily threat roundup from thrunt.me](https://thrunt.me/briefs/2026-10-19/) counted 18 new ransomware victim postings across seven groups on October 19, and eight of them came from N0n. That is nearly half the day's total from a single crew. ## Why infostealers sit behind the wave Trackers link the surge to infostealer infections. Infostealers harvest saved logins and session data from infected devices, and that material can feed ransomware crews. One infected laptop with a saved VPN login or a live browser session can expose a company that never knew it had a problem. The sources do not say how the SQA Services credentials were obtained. The infostealer link is a pattern across the reporting, not a confirmed cause for any single listing. That distinction matters for readers asking whether their own company is at risk. The same malware can reach any employee's device, regardless of company size. ## How much of this can you trust Verification is the weak point of this story. [RedPacket Security](https://www.redpacketsecurity.com/n0n-ransomware-victim-smic-us-company-sunnyvale-ca-us-arm-of-semiconductor-manufacturing-international-corpo/) warns in its write-up of the SMIC listing that N0n posts have included unverified or fabricated victim claims. It advises treating each post as unconfirmed until independent evidence appears. That advice applies to Finzly as much as to any other name on the list. Several questions remain open. Finzly has not said whether it was breached, and none of the sources report how many customers were affected. I found no confirmations from SQA Services, SMIC US Company or the other named firms. Whether the posted files are authentic is also unknown, and the group's "82 victims" count rests on a single tracker. For context on how disclosure can lag behind a leak, USA 24 reported that [CenterPoint Energy's breach hit 1,062,060 Texans, with notices still pending](https://usa-24.com/centerpoint-energy-data-breach-texas/). A leak-site post can appear in a day, while the formal notice process can run for months. ## What to do if your company or a vendor is named Start with the accounts and vendors that touch payments, cloud and remote access. Then work outward. - Rotate cloud and API keys for any vendor tied to a named victim, starting with payment and banking integrations. - Audit VPN and administrator accounts for unused, shared or long-lived credentials, and remove any you cannot justify. - Check employee devices for infostealer infections, and reset saved passwords and revoke active sessions on any machine that shows one. - Require phishing-resistant multifactor authentication for remote access and admin logins. - Ask key vendors in writing whether they have appeared on a leak site, and what they have confirmed. To check a name, search a ransomware tracker such as Ransomware.live. Remember that these sites aggregate postings without verifying them. A listing is a reason to ask questions, not proof of a breach. ## What to watch next Three developments will shape how this story reads in the coming weeks. First, watch whether Finzly issues a statement, files with a regulator or notifies customers. Any of those would turn a leak-site claim into a confirmed incident. Second, watch whether the group publishes samples that outside researchers can authenticate. Third, watch whether listings keep moving from financial firms into IT services and manufacturing, which would suggest the crew is working through the vendors that serve them. Those answers will show whether the eight N0n postings on October 19 were a spike or the start of a sustained run. For a related look at how extortion crews are being pursued, read [the arrest of a Canadian cybersecurity executive in the FBI's ShinyHunters probe](https://usa-24.com/shinyhunters-fbi-breach-arrest/). ## Frequently asked questions ### Has Finzly Corp confirmed a breach? Not as of the reporting. Finzly has not issued a statement, regulatory filing or breach notice confirming an intrusion or describing what data was taken. The claims come from the N0n leak site and have not been independently verified. ### What is the N0n ransomware group? N0n is a financially motivated extortion group that first appeared in September 2026. It relies on credentials stolen by infostealer malware and pressures victims by publishing data rather than encrypting their systems. Its victims so far are concentrated in US firms. ### How can I check whether my company is on the N0n leak site? Search a ransomware tracker such as Ransomware.live for your company's name and review the listing date and claims. Trackers aggregate leak-site postings without verifying them, so a listing is a reason to investigate rather than proof of a breach. Ask your security team to review VPN, admin and cloud credentials. ### What is an infostealer, and why does it matter here? Infostealers are malware that harvest saved logins and session data from infected devices. Trackers link the N0n wave to infostealer infections, and that stolen material can feed ransomware crews. Checking employee devices for infections is one of the most direct steps a company can take. ### How many victims has N0n claimed? One tracker, SOCRadar, counts 82 total victims, averaging about 41 a month. Those figures come from a single aggregator of leak-site postings. On October 19 alone, a daily roundup attributed eight of 18 new ransomware postings to N0n. ## Sources 1. [Ransomware.live — Victim: Finzly Corp](https://www.ransomware.live/id/Rmluemx5IENvcnBATjBu) 2. [DeXpose — N0n Ransomware Group Attacks Fintech Leader Finzly Corp](https://www.dexpose.io/n0n-ransomware-group-attacks-fintech-leader-finzly-corp/) 3. [Quasar Cyber Tech QPulse — N0n Ransomware Group Claims Breach of Finzly Corp Exposing Payment Infrastructure Credentials](https://qpulse.quasarcybertech.com/news/7017/n0n-ransomware-group-claims-breach-of-finzly-corp-exposing-payment-infrastructure-credentials) 4. [SOCRadar — n0n Ransomware Group Profile](https://socradar.io/free-tools/ransomware-intelligence/groups/n0n) 5. [Ransomware.live — Victim: SMIC US Company (Sunnyvale, CA)](https://www.ransomware.live/id/U01JQyBVUyBDb21wYW55IChTdW5ueXZhbGUsIENBIOKAlCBVUyBhcm0gb2YgU2VtaWNvbmR1Y3RvciBNYW51ZmFjdHVyaW5nIEludGVybmF0aW9uYWwgQ29ycG8uLi5ATjBu) 6. [RedPacket Security — [N0N] Ransomware Victim: SMIC US Company](https://www.redpacketsecurity.com/n0n-ransomware-victim-smic-us-company-sunnyvale-ca-us-arm-of-semiconductor-manufacturing-international-corpo/) 7. [Kalir Pulse — SQA Services Inc ransomware attack — n0n leak](https://pulse.kalir.io/en/ransomware/n0n/603dcf87f9) 8. [Hookphish — Ransomware Group N0n Hits: SQA Services Inc](https://www.hookphish.com/blog/ransomware-group-n0n-hits-sqa-services-inc/) 9. [Hookphish — Ransomware Group N0n Hits: Company #85](https://www.hookphish.com/blog/ransomware-group-n0n-hits-company-85/) 10. [Hookphish — Ransomware Group N0n Hits: Company #80](https://www.hookphish.com/blog/ransomware-group-n0n-hits-company-80/) 11. [thrunt.me — Morning Brief, October 19, 2026](https://thrunt.me/briefs/2026-10-19/) 12. [Hookphish — Ransomware Group N0n Hits: Finzly Corp](https://www.hookphish.com/blog/ransomware-group-n0n-hits-finzly-corp/)