A ransomware gang called N0n has posted a claim against Staples, Inc. / SBD Inc., alleging it took business records, shopper data and a small set of Social Security numbers. The post is dated November 7, 2026. Staples has not confirmed any incident, and USA 24 found no regulator filing or independent investigation that supports the claim. Ransomware.live logged the victim the same day with a US country tag, and RedPacket Security summarized what the post says it contains. Treat this as a developing lead, not a confirmed Staples data breach.
What the Staples data breach claim contains
RedPacket Security describes the post as dated November 7 and labels the status as not paid and exposed. According to that summary, the post lists the following material.
| Claimed item | Scale stated in the post | Who could be affected |
|---|---|---|
| Product profit-margin records | Unit sales and revenue for 64,041 products | Business confidentiality rather than personal data |
| Shopper activity logs | IP addresses, search terms and device details | Online shoppers |
| Chat transcripts | Callback phone numbers | Customers who used chat support |
| Staff directory | Nearly 200 employees, with names and email addresses | Employees, who face phishing risk |
| Service-chat table | Social Security numbers and dates of birth for 30 individuals | The 30 people named in the post |
The post also refers to a daily file holding 381,964 records. The table reflects what the group says, not what anyone has verified, so treat every line as a claim.
Ransomware.live recorded the victim at 10:54 UTC on November 7 and estimated the attack date as the same day. RedPacket notes that the post gives no compromise date, so the actual intrusion window is unknown. That gap matters, because a same-day estimate may reflect when the group posted the claim rather than when it got in.
Why the Social Security number claim matters most
Thirty people is a small number, but the Social Security claim carries the most personal risk. A Social Security number paired with a date of birth is among the most useful data for identity thieves, since it can help open credit accounts or file a false tax return in a victim's name. The post's description is still a claim, not proof that those records exist.
Leak-site claims are often inflated or partly fabricated. Trackers such as Ransomware.live and RedPacket Security republish them without checking the underlying files, so neither site vouches for the data. The SSN detail needs confirmation from the company or a regulator before anyone should treat it as established.
If the records are real, the bigger problem is data handling rather than one attacker. A service-chat table should not hold Social Security numbers in the first place, and a support tool that keeps them for long periods widens the damage from any intrusion. Most states have breach notification laws that cover Social Security numbers, and some require notice to the state attorney general. A confirmed exposure would likely leave a paper trail.
Why N0n's November claims suggest a campaign
The Staples post is not an isolated listing. A separate Ransomware.live entry, Company #129, points to further N0n claims dated November 4, 2026. Those include US Company #128, US Company #130 and US Company #132, along with a company tagged DE.
A cluster of victims posted within a few days points to a group working through a target list rather than making a single hit. The Staples claim also appeared on the same day as a wave of claims from Metaencryptor and N0n against US companies. One November 7 Metaencryptor claim names Pekin Insurance, a US insurer, according to Ransomware.live. USA 24 has not verified that listing and treats it only as a lead.
Retailers face a specific risk here. Shopping platforms hold payment details, account histories and support conversations, which is exactly the mix attackers want. USA 24 recently covered the Revolve data breach, which exposed saved cards for as many as 1.5 million people.
Staples' March 2026 lawsuit is a separate case
Staples already faces litigation over an earlier incident. A proposed class action reported by ClassAction.org describes a March 2026 cyberattack and says a ransomware group known as CoinbaseCartel claimed responsibility for an attack on Staples' network on March 11, 2026. The complaint runs 41 pages.
Nothing in the research links that case to the N0n claim, and the two incidents may be unrelated. Still, the lawsuit shows that Staples is already under legal scrutiny over how it protects data. A confirmed second incident in the same year would put both events on the record, and plaintiffs, regulators and customers would judge the company's response to each.
Is the Staples data breach confirmed? What to check
As of publication, USA 24 found no statement from Staples, Inc., SBD Inc. or N0n that confirms the attack. Three open questions matter most. The first is the relationship between Staples, Inc. and SBD Inc., which the sources do not explain. Leak listings sometimes use legal entity names that differ from consumer brands, so the name alone does not show which business unit is involved. The second is whether the records are authentic, and the third is whether this claim connects to the March incident. Nothing found so far answers the third question.
Three places will show whether the claim holds up. Staples' own newsroom and customer support pages would carry an official notice. Notification letters, if the company sends them, would arrive by mail to affected people. Some state attorneys general also publish breach notices online, which often list the number of affected residents. A company statement with a resident count would tell you more than any leak-site post.
What to do if you shopped at Staples or work there
No action is required unless Staples confirms a breach. A few habits reduce risk now, though.
- Treat unexpected emails, texts or calls that mention an order, a support chat or a callback as suspicious. Go to the Staples website or app directly instead of following links.
- Never share one-time codes, passwords or payment details with someone who contacts you first, even if the message includes accurate order details.
- Staff should expect phishing that uses names and email addresses from internal directories. Report unusual messages to IT before replying.
- If Staples confirms that Social Security numbers were exposed, place a free credit freeze with Equifax, Experian and TransUnion. A freeze blocks new credit accounts from opening in your name until you lift it.
Breach-check tools such as Have I Been Pwned can show whether an email address appeared in known leaks, as a recent USA 24 story on a Harvard breach explains. Nothing in the research shows the Staples claim has been added to that database.
Business readers have a separate task. Office-supply and retail firms should review what chat transcripts and analytics logs retain, and for how long. They should also ask whether support tools need to collect Social Security numbers at all, mask sensitive fields in logs and restrict who can query them. Shorter retention limits what an intruder can take.
What comes next for the Staples claim
Three signals will shape how seriously to take this claim. Staples or SBD Inc. may issue a statement, file with a state regulator or mail notices. N0n may publish more files or update the listing, which would give researchers material to test for authenticity. The other November 4 and November 7 victims may confirm or dispute their claims, which would show how much of the group's data holds up across targets.
USA 24 will update this story if the company, a regulator or an independent investigation confirms or disputes the claim.
