The ransomware group known as N0n has claimed it published data belonging to Lampenwelt GmbH, a German online lighting retailer, in a leak-site post dated 7 November 2026. The claim has not been confirmed by the company, and no independent evidence has yet established that a breach took place.

According to threat intelligence reports tracking the post, the material the group claims to have exposed includes roughly 81 million raw search queries typed by shoppers on the retailer's storefronts. The reports say the search data contains hundreds of real customer email addresses that shoppers entered into the search box.

The group is also said to have published internal business data, including per-product unit costs and rolling revenue figures for more than 200,000 products across four country stores, from which profit margins could be worked out, plus the silver, gold and platinum net price tiers offered to business customers.

The listing is marked "NOT PAID — EXPOSED", which the trackers interpret as meaning no ransom was paid and the data has been made public. No ransom amount has been disclosed, and the reports do not say how the group claims to have gained access.

Lampenwelt has not publicly confirmed the incident, and the available reporting does not establish whether company systems were encrypted, whether data was taken, or whether operations were disrupted. A ransomware victim announcement is not, by itself, proof of a breach.

ZeroFox recorded at least 73 incidents attributed to N0n in October 2026. Shoppers who typed personal details into the retailer's search box should watch for phishing attempts, and businesses should note that even search logs can carry commercial secrets.

[Source: qpulse.quasarcybertech.com](https://qpulse.quasarcybertech.com/news/7982/n0n-ransomware-group-leaks-proprietary-pricing-and-customer-search-data-from-lampenwelt-gmbh) | [Source: redpacketsecurity.com](https://www.redpacketsecurity.com/n0n-ransomware-victim-lampenwelt-gmbh/)