The ransomware group known as N0n has listed Hallmark Cards, Inc. as a victim on its leak site, claiming it stole a large archive of customer and staff data from the American greeting card company. Hallmark has not confirmed a breach, and the claim has not been independently verified.

According to threat intelligence platform ThreatMon, which first recorded the listing on 6 November 2026, the group claims the stolen data includes a complete conversation corpus from Hallmark's AI shopping assistant: 221,978 customer chat sessions containing 340,407 messages, spanning April to October 2026. The listing also claims 133 customer phone numbers and 401 order numbers typed by shoppers into chat conversations, along with 30,368 live storefront search requests and 8,047 unique visitor identifiers from August to October 2026.

The group further claims to hold product search embeddings for Hallmark's full catalogue and staff identity records. The listing is marked "NOT PAID — EXPOSED", which in leak-site terms signals that the group says it has published or is prepared to publish the data because no ransom was paid.

Claim, not confirmed breach

A leak-site listing is evidence of an attacker's claim, not proof that a breach happened. No verified stolen-data samples, breach size or ransom demand has been made public, and there is no indication yet that Hallmark has issued its own notification to customers. The same retailer was first tracked as an unnamed victim, "Company #121", on 3 November before being named as Hallmark on 6 November.

N0n is a fast-growing extortion group that emerged in September 2026 and has listed well over 100 victims since, according to leak-site trackers. Customers who used Hallmark's online shopping assistant between April and October 2026 should watch for phishing messages referencing recent orders.