The ransomware group known as N0n has claimed responsibility for an attack on Female Daily Network, an Indonesian beauty community and shopping platform, and says it has exposed a large volume of user and employee data. Threat intelligence firm QPulse reported on 13 November 2026 that the incident was discovered on 12 November, the same day the group claimed the attack, and that the exposed data remains publicly accessible.

According to QPulse, the material the group claims to hold includes 651,641 forum accounts, 4,873,512 forum posts and 195,328 private member messages. The leak is also said to contain 910,397 giveaway participant records from December 2024, event entrant lists containing full home addresses, and 10,370 job applicant CVs from 2025 and 2026 that include home addresses and phone numbers.

Further categories of data in the claimed leak include 35,458,383 member activity events, 1,203,613 beauty concern profiles and 773,115 product reviews. QPulse reports that general member records in the leak expose full names, email addresses, dates of birth, phone numbers and password hashes.

What the claims mean for users

QPulse rates the incident high risk and warns that the exposure of password hashes and personal contact details leaves affected users open to identity theft, phishing and credential stuffing, in which stolen passwords are tried against other services. The firm advises Female Daily users to change their password on the platform and on any other service where they reused the same credentials, and to watch for phishing attempts by email or phone.

The reports reviewed did not include a public response from Female Daily Network, and the group's claims have not been independently verified. The figures in this article are the figures reported by QPulse from the group's claims, not confirmed totals from the company itself.

N0n is surging across ransomware leak sites

The Female Daily claim fits a wider pattern. Threat researchers at NinjaLabz, writing on 13 November 2026, report that N0n posted 90 leak-site claims in seven days, against 28.56 expected from the group's own previous rate, a surge they describe as statistically significant. Across the groups they track, 360 leak-site claims appeared in the same seven-day window from 47 of 277 groups.

N0n emerged in September 2026 and has become one of the most active extortion groups on leak sites, according to reporting on the group this week. Security researchers have previously reported that the group has listed more than 100 victims in November alone, although many are listed only as numbers on its leak site, and that its claims are often data exposure operations rather than encryption attacks.

QPulse's advisory also urges organisations in retail and e-commerce to audit how long they keep personal data, noting that the Female Daily leak is said to include job applications and event participation lists from past years. The firm recommends notifying affected users, forcing a password reset, monitoring for phishing and credential stuffing, and reviewing data retention and encryption practices.

Users of Female Daily Network who are concerned should change their password immediately, turn on two-factor authentication where it is available, and treat unexpected messages asking for login details or payments as suspicious.