N0n claims leak of 441,000 LEO Pharma patient…

CriticalBreachNo software to update

In 30 seconds

Alleged

The latest report says the N0n group claims it published data attributed to LEO Pharma after the company did not pay. The claimed material includes 315 million analytics rows and 441,000 patient-support records, but LEO Pharma has not confirmed an intrusion and the claim remains unverified.

What happened

Alleged

N0n first appeared in the supplied evidence as having added Danish drugmaker LEO Pharma to its leak site, describing the purported data as a “patient companion analytics corpus.” A later report said the group was claiming an actual leak, moving the story from a listing with unclear contents to an alleged publication of data.

Why it matters

Inferred

If authentic, the claimed patient-support records could expose sensitive health-related information because the reported fields include prescriptions, insurers and diagnosis codes. The evidence does not establish that these records are genuine or that they came from LEO Pharma.

What to do

Observed

Treat the leak-site entry as an unverified threat-actor claim, not as confirmation of a breach. The supplied evidence contains no public instructions from LEO Pharma for patients, employees or partners.

Confirmed and still uncertain

Observed

Two monitoring accounts report that N0n listed LEO Pharma and later claimed to have released data. What remains unknown includes whether an intrusion occurred, whether the files are authentic, how the data was obtained, when any incident happened and how many people, if any, were affected.

What people are saying

Alleged

IntCyberDigest reports that N0n said LEO Pharma did not pay and claims the group leaked patient data. DailyDarkWeb separately warns that the listing should be treated as an unverified claim because neither LEO Pharma nor independent evidence has confirmed an intrusion.

Evolution

Alleged

The earlier report described a leak-site listing whose full size and record types were unclear. The later report supplied more specific claims: 315 million analytics rows and 441,000 patient-support records, along with an assertion that the data had been leaked. Those added details have not been independently validated in the supplied evidence.

Reach

Observed

2 independent groups, 3 updates, and 4 engagements.

Technical detail

Alleged

The alleged dataset is described as a patient-companion analytics corpus. One report attributes prescriptions, insurer information and diagnosis codes to the 441,000 patient-support records, while the 315 million figure refers to analytics rows. No file samples, schema, forensic indicators or technical account of an intrusion are included in the evidence.

Sources and evidence

Observed

The evidence consists of two posts from cybercrime-monitoring accounts on X, both describing material attributed to N0n’s leak site. It includes screenshots, but no statement from LEO Pharma, independently authenticated files, forensic report or confirmation from an affected party.