A ransomware crew calling itself N0n posted US fintech payments firm Finzly Corp to its leak site on October 19, 2026, claiming it had taken network configuration details, payment-infrastructure access secrets and cloud access keys. Finzly has not confirmed an intrusion, and I found no regulatory filing or breach notice that does. The N0n ransomware group is still adding victims, so this story is about scale and pattern, not confirmed breach totals.
What the Finzly leak listing claims
The listing first appeared at 01:23 UTC on October 19, according to Ransomware.live. Hookphish lists the company the same way, as a US fintech payments firm, and Quasar Cyber Tech's QPulse frames the claim as exposure of payment-infrastructure credentials.
The entry says the group took four kinds of material: network configuration details, payment-infrastructure access secrets, cloud environment topology and cloud access keys. It labels the data "NOT PAID — EXPOSED," a status the group assigns itself. The trackers I reviewed, including DeXpose, rely on that leak-site text rather than independent evidence.
Why this listing matters comes down to what the group says it holds. Payments firms sit between banks, merchants and consumers. If the claim holds, a stolen key that opens payment infrastructure could be a route to fraud, and any customer or partner integrated with that system could face unauthorized access risk. Cloud topology would also give an intruder a map of where to go next.
Why the N0n ransomware group skips encryption
SOCRadar's group profile describes N0n as a financially motivated extortion crew that first appeared in September 2026. It relies on stolen credentials from infostealer malware and pressures victims by publishing data rather than encrypting their systems. That is a different playbook from the lock-and-demand model most readers picture when they hear the word ransomware. The threat is exposure, not downtime, and exposure can pressure a company even when its own systems keep running.
The same profile says 97.5 percent of N0n victims are listed as "claimed" by the group, and 1.2 percent are marked as data leaked. Those are the tracker's labels, not verified breach outcomes. The tracker also counts 82 total victims, averaging about 41 a month. Because those numbers come from one aggregator, read them as a rough measure of pace rather than an audited count.
The victims so far are concentrated in US firms. For American companies, that makes the group's pattern more than a foreign problem with a domestic spillover.
The other US companies on N0n's recent list
Finzly is not the only name. Trackers have logged several recent US victims, and the sample below shows how the claims differ.
| Victim | Location | Listing date | What the listing claims |
|---|---|---|---|
| Finzly Corp | US fintech payments firm | October 19, 2026 | Network configuration details, payment-infrastructure access secrets, cloud topology and cloud access keys |
| SQA Services Inc. | Software quality assurance, California | October 18, 2026 | VPN credentials for 64 employee accounts, domain controller configuration details |
| SMIC US Company | Sunnyvale, California | October 18, 2026 | Corporate files, payroll records and financial documents |
SQA Services is the clearest example of the access problem. Kalir Pulse and Hookphish both report the claim. VPN logins combined with domain controller details are the kind of pairing that could let an intruder move from one employee's remote session toward the core of a corporate network. If the claim is accurate, 64 accounts is a wide surface.
The SMIC listing says corporate files, payroll records and financial documents were posted. Ransomware.live logged it. Payroll records can include employee names, addresses and bank details, so staff at any firm named in a listing should expect phishing that uses real personal information.
Other recent listings include a Texas managed IT services firm, labeled Company #80, and a US IT services firm, labeled Company #85. Hookphish covers the first, and a separate Hookphish post covers the second. Unnamed listings are hard for customers to check, and an IT provider's clients could face downstream risk if stolen VPN or admin credentials were used.
The sector spread runs from financial services to IT services and manufacturing, according to the trackers that flagged these victims. A daily threat roundup from thrunt.me counted 18 new ransomware victim postings across seven groups on October 19, and eight of them came from N0n. That is nearly half the day's total from a single crew.
Why infostealers sit behind the wave
Trackers link the surge to infostealer infections. Infostealers harvest saved logins and session data from infected devices, and that material can feed ransomware crews. One infected laptop with a saved VPN login or a live browser session can expose a company that never knew it had a problem.
The sources do not say how the SQA Services credentials were obtained. The infostealer link is a pattern across the reporting, not a confirmed cause for any single listing. That distinction matters for readers asking whether their own company is at risk. The same malware can reach any employee's device, regardless of company size.
How much of this can you trust
Verification is the weak point of this story. RedPacket Security warns in its write-up of the SMIC listing that N0n posts have included unverified or fabricated victim claims. It advises treating each post as unconfirmed until independent evidence appears. That advice applies to Finzly as much as to any other name on the list.
Several questions remain open. Finzly has not said whether it was breached, and none of the sources report how many customers were affected. I found no confirmations from SQA Services, SMIC US Company or the other named firms. Whether the posted files are authentic is also unknown, and the group's "82 victims" count rests on a single tracker.
For context on how disclosure can lag behind a leak, USA 24 reported that CenterPoint Energy's breach hit 1,062,060 Texans, with notices still pending. A leak-site post can appear in a day, while the formal notice process can run for months.
What to do if your company or a vendor is named
Start with the accounts and vendors that touch payments, cloud and remote access. Then work outward.
- Rotate cloud and API keys for any vendor tied to a named victim, starting with payment and banking integrations.
- Audit VPN and administrator accounts for unused, shared or long-lived credentials, and remove any you cannot justify.
- Check employee devices for infostealer infections, and reset saved passwords and revoke active sessions on any machine that shows one.
- Require phishing-resistant multifactor authentication for remote access and admin logins.
- Ask key vendors in writing whether they have appeared on a leak site, and what they have confirmed.
To check a name, search a ransomware tracker such as Ransomware.live. Remember that these sites aggregate postings without verifying them. A listing is a reason to ask questions, not proof of a breach.
What to watch next
Three developments will shape how this story reads in the coming weeks. First, watch whether Finzly issues a statement, files with a regulator or notifies customers. Any of those would turn a leak-site claim into a confirmed incident. Second, watch whether the group publishes samples that outside researchers can authenticate. Third, watch whether listings keep moving from financial firms into IT services and manufacturing, which would suggest the crew is working through the vendors that serve them.
Those answers will show whether the eight N0n postings on October 19 were a spike or the start of a sustained run. For a related look at how extortion crews are being pursued, read the arrest of a Canadian cybersecurity executive in the FBI's ShinyHunters probe.
