The data-extortion group known as N0n has named two major American companies, LiveRamp and DraftKings, on its leak site, claiming to hold data belonging to both. The listings appeared on 11 November 2026, according to threat intelligence firm ThreatMon. Neither claim has been independently verified, neither company has publicly confirmed a security incident, and no sample data has been published.

That distinction matters. A listing on a threat actor's leak site is a claim, not proof of a breach. It does not establish that the group's members got inside either company's systems, that they took the data they describe, or that any customer information has been exposed. What it does establish is that N0n is publicly associating two well-known names with its extortion operation.

What the group claims to hold

The LiveRamp listing is the more detailed of the two. LiveRamp is a US data collaboration and identity-resolution company, helping organisations connect consumer information across different digital environments.

According to the listing, the group claims to hold identity-graph feeds spread across about 39,055 files, totalling 2.2 terabytes and dated October 2026. It also describes 1,006 audience-delivery files totalling 220.5 gigabytes, covering purchase, streaming, demographic and predictive segments, and claims that 19.2 million hashed email identities in those audiences were resolved to named individuals. The material is marked "[NOT PAID - EXPOSED]", a label the group uses for listings it says it has published after a victim declined to pay.

Those numbers need careful handling. A file count is not a count of affected people, and the listing does not show whether the files contain current records, outdated material, duplicates or genuinely sensitive personal information. Without published samples, nobody outside the group can check what it actually holds.

DraftKings named alongside LiveRamp

DraftKings, the US sports betting and fantasy sports platform, was named in the same round of listings. The claim against it describes 6.3 million mobile device advertising identifiers across three gaming audiences, and 7.4 million hashed consumer email addresses across two gaming audiences, both dated 2020, of which 2,886,388 were resolved to named individuals. It also mentions demographic analytics for a November 2019 campaign covering 11,421 devices.

As with LiveRamp, there is no evidence in the reporting that customer accounts, payment information or betting records were accessed, and no sign that DraftKings' systems were encrypted. The dates in the claim are also worth noting: the material described is several years old, which says nothing on its own about whether it is genuine, but does mean that even a real dataset of this kind would not necessarily reflect the company's current customers.

A possible link to an earlier listing

The LiveRamp listing may be connected to an earlier one. On 2 November, N0n listed an unnamed victim, "Company 116", described as a US data collaboration and identity-resolution company. The newly named LiveRamp listing appears to identify that organisation, although the connection has not been independently established. If the two listings refer to the same victim, the group may have concealed the name first and revealed it later to increase pressure.

N0n itself is a prolific newcomer. According to Dark Web Intelligence reporting cited by Undercode News, the group has published more than 200 claims since September 2026. A high volume of listings demonstrates activity, not accuracy. That history is one reason the LiveRamp and DraftKings claims should be treated with caution until corroborating evidence appears.

Why the claims are not confirmed

Several pieces of evidence are missing. No samples of the alleged data have been published, so researchers cannot test whether the files match genuine LiveRamp or DraftKings data structures. There is no confirmed information about how the group supposedly got in or whether it reached internal systems. The available reporting does not establish a ransom demand, a payment or any operational disruption at either company.

LiveRamp's position in the identity-resolution ecosystem is what makes the allegation worth monitoring even while it is unconfirmed. If genuine identity-graph feeds had been taken, attackers could use the relationships between identifiers to build more convincing phishing campaigns, to profile individuals or to link data that had previously appeared unrelated. DraftKings' risk is different: as a consumer-facing platform, any confirmed exposure would raise immediate questions about account security and payment data.

What to watch next

The next developments that would change the picture are clear: verifiable samples of the alleged data, credible technical indicators, or a public statement from either company. Until one of those appears, both claims remain unverified threat-actor allegations. Organisations that use identity-resolution services should still review their data-sharing arrangements and check for unusual bulk exports. For everyone else, the practical advice is unchanged: be wary of phishing messages that seem unusually well-informed about you, use unique passwords, and turn on two-factor authentication where it is available.