The N0n ransomware group has added two more unnamed victims to its leak site, one in the United States and one in Canada, according to threat intelligence reports published on 8 November 2026. The two listings, recorded as Company 147 and Company 138, were reported in ThreatMon's 8 November monitoring update.

Company 147 is described as a coffee retailer based in the United States. It was listed on 7 November at 21:30 UTC, and its status is marked "pending exposure", meaning the attackers have named the victim but have not yet published stolen data. No further technical details were given about how the company was reached or what was taken.

Company 138, the Canadian listing, is even thinner: no industry, identity or detail has been published at all. Both claims are unverified, and neither report provides data samples, ransom demands or evidence of a successful intrusion. The reports note that infostealer infections are feeding N0n's pipeline, citing intelligence from Hudson Rock.

The two new entries fit N0n's recent pattern of fast, high-volume claims, many of them naming victims only by number. Companies should watch for infostealer infections on their own networks, since stolen credentials are a common first step into ransomware incidents, and treat any N0n listing naming a supplier as a prompt to check exposed logins. Until the victims are identified or data appears, the listings should be treated as allegations, not confirmed breaches.

[Source: qpulse.quasarcybertech.com](https://qpulse.quasarcybertech.com/news/8008/ransomware-group-n0n-claims-coffee-retailer-as-victim-147) | [Source: undercodenews.com](https://undercodenews.com/n0n-ransomware-claims-two-additional-victims-in-the-united-states-and-canada-video/)