Ransomware group N0n has published what it says is more than 217,000 client documents belonging to Higginbotham, a large independent insurance brokerage in the United States. The data appeared on the group's leak site on 7 November 2026, marked "NOT PAID — EXPOSED", indicating the group released the files after a ransom demand was not met. Higginbotham has not publicly confirmed the breach claim, and the stolen data has not been independently verified.

What was allegedly exposed

According to the leak-site listing, the published material comprises client policy and working documents dating from 2013 through 2026. It reportedly includes workers' compensation and property policies, carrier underwriting questionnaires and producer reports containing client codes, names and policy numbers, as well as commission and benefits data and customer relationship records. The listing is described as a complete correspondence attachment store. The technical route the attackers allegedly used to gain access has not been disclosed, and no ransom figure has been published for this case.

A busy day for N0n

N0n is one of the most active extortion groups currently operating, with more than 200 victims listed since it first appeared in September 2026. Threat trackers recorded 28 ransomware leak-site claims in a single 24-hour period, with N0n accounting for eight of them — more than any other group. The Higginbotham listing was one of several N0n disclosures on 7 November. Insurance clients whose details may be affected should watch for identity theft and fraud attempts, and treat unsolicited contact citing policy details with suspicion.

[Source: QPulse / Quasar CyberTech](https://qpulse.quasarcybertech.com/news/7984/n0n-ransomware-group-leaks-over-217-000-documents-from-insurance-brokerage-higginbotham) | [Source: DataBreachRights](https://databreachrights.com/higginbotham-data-breach/)