BRIEFRansomwarehighP66
n0n ransomware leaks client data of Canada's MM Insurance Agency
MM Insurance Agency
Detected14 November 2026 · 22:14 UTC
The n0n group published records from a Canadian financial advisory firm, including signed registered-plan documents, investment summaries, insurance policies and identity documents such as driver licences, a marriage certificate and a death certificate. Client banking details and tax slips containing social insurance numbers are also exposed, along with a graph of 2,219 distinct client contacts. This is severe identity-theft material affecting named individuals and warrants notification and monitoring.
CategoryRansomware
Severityhigh
Priority score66
Detected14 November 2026 · 22:14 UTC
RansomwarePriority 42
Ransomware Qilin publica al fabricante Kayaku Safety Systems MalaysiaThe Qilin ransomware group added Kayaku Safety Systems Malaysia, an automotive safety-components manufacturer, to its leak site with no data description published yet. Listing alone signals a claimed intrusion into an industrial supplier that sits in regional automotive supply chains. No samples or record counts are visible, so impact is unconfirmed but worth tracking for supply-chain risk.RansomwarePriority 68
Ransomware n0n publica datos de la empresa estadounidense PollstarThe n0n ransomware group listed Pollstar, a US concert-trade data company, publishing 135,621 named contacts with phones, emails and addresses plus 26,527 quote and invoice documents. The stolen archive covers booking managers, venues, promoters and talent buyers, plus sales and box-office records. It matters because a B2B contact trove of this size enables highly targeted phishing and invoice fraud against live-events companies across the region.RansomwarePriority 57
Ransomware ScarlettGroup publica a la británica FittleworthThe ScarlettGroup ransomware crew has listed Fittleworth, a UK provider of home-delivered medical supplies and stoma/continence care, on its leak site. As a healthcare supplier handling sensitive patient logistics, disruption or data exposure can harm vulnerable patients. Defenders in healthcare supply chains should monitor for data publication and follow-on phishing.RansomwarePriority 70
Ransomware Barracuda publica a la maderera española FINSAThe Barracuda ransomware group listed FINSA, a large Spanish wood-processing company, claiming theft of 800 GB of production and internal files and disruption of its virtualization infrastructure. The post states that operations were halted, indicating a high-impact intrusion against an industrial firm. Spanish organizations and FINSA's business partners should assess exposure.RansomwarePriority 58
Ransomware Endzone publica a la operadora Momentum TelecomThe Endzone group listed Momentum Telecom, a US cloud-voice and SD-WAN provider with about $221M in revenue, claiming access through a compromised Multi-Service Operator provisioning tool. Provisioning and diagnostic systems sit close to customer call flows, so exposure can enable interception and downstream compromise of business clients. Carriers and resellers that depend on these services need to check third-party access.RansomwarePriority 45
Ransomware Everest publica a la alemana Grundbaulabor TrierThe Everest ransomware group listed Grundbaulabor Trier GmbH, a German geotechnical and soil-testing laboratory, on its leak site. The victim is in the manufacturing/engineering sector in Germany, outside the LATAM region. It signals ongoing Everest activity but with limited direct regional impact.