The ransomware group known as N0n has claimed it stole a complete claims data warehouse from Dompé Farmaceutici S.p.A., an Italian pharmaceutical company, in an attack on the firm's United States ophthalmology business. Dompé has not confirmed the claim, and no independent verification has been published.

The listing appeared on N0n's leak site on 6 November 2026 and was recorded by the ransomware.live tracker at 10:54 UTC the same day. According to the listing, the group exfiltrated patient dimension tables, drug, diagnosis and plan dimensions, and full archives of prescriptions, procedures and diagnosis claims for the company's US eye-care operations. The data is marked "NOT PAID — EXPOSED", the group's label for data it says it has published after no ransom was paid.

Dompé, based in Italy, develops treatments in biotechnology and specialty pharmaceuticals, including ophthalmology. The listing describes the affected data as belonging to the company's US business, so the claimed exposure concerns American patient and claims records rather than the firm's Italian operations. No ransom amount has been reported for this listing, and no sample of the claimed data has been independently authenticated.

Claim, not confirmed breach

As with all leak-site claims, the listing alone does not establish that a breach occurred, that the data described was actually taken, or that the group's description of its contents is accurate. Threat trackers record the claim as unverified, and Dompé has not issued a public statement about the listing.

N0n has been one of the most active extortion groups since emerging in September 2026, listing more than 100 victims in its first two months, according to leak-site trackers. Its recent claims span retail, healthcare, logistics and manufacturing, and it has repeatedly targeted pharmaceutical companies, including an unnamed Danish firm listed days earlier.