1. Executive summary
The N0n ransomware group listed a Spanish smart grid engineering firm, indexed as Company #110, on its leak site on 2026-10-23. The listing carries a pending-exposure marker, which means the group has claimed the victim but has not yet published stolen data. No CVE, CVSS score, EPSS estimate or CISA KEV entry is associated with this item, and no technical detail of the intrusion (initial access, tooling, encryption, exfiltration volume) has been disclosed. The risk to EMEA financial services is indirect but specific: smart grid engineering firms sit in the supply chain of energy providers and, through them, of the banks and payment firms those providers serve, so a confirmed breach at this victim would raise third-party and concentration questions under DORA. The listing is unverified and single-sourced to the leak-site index.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | The victim is a smart grid engineering firm, a type of ICT third-party provider that financial entities rely on for energy and infrastructure services. | Clients that contract this firm, or firms like it, must assess whether the exposure affects their own ICT third-party arrangements and whether contractual exit or substitution options exist. |
| DORA Art. 29 | A single engineering firm serving multiple energy and financial downstreams concentrates risk if the breach is confirmed. | Clients should test whether this provider is a concentration point in their own dependency map before treating the listing as noise. |
No specific DORA/NIS2 article is directly engaged by the incident-reporting obligations in this item, because the listing is a claim by the actor and not a confirmed incident at any financial entity.
3. Technical analysis & attack chain
The source material does not support a confirmed attack chain. The only facts available are the group name (N0n), the victim description (a Spanish smart grid engineering firm, indexed as Company #110), the country (ES), the listing date (2026-10-23) and the status marker (pending exposure). No initial access vector, exploited component, malware family, persistence mechanism, command-and-control infrastructure, lateral movement path or exfiltration detail is present in the source.
What can be said with confidence is limited to the listing itself. N0n operates a leak site and has posted a victim entry. The pending-exposure marker indicates the group is at the claim stage and has not published data. Whether encryption occurred, whether data was taken, and what volume, are all unknown from this source.
Attribution to N0n rests on the leak-site index alone. No MITRE ATT&CK profile for N0n is available in the reference data supplied with this item, so the group's tradecraft, tooling and typical initial-access patterns cannot be characterised here. Treat the attribution as unconfirmed and the technical picture as absent until a first-party report or a victim statement is available.
4. Mitigation & containment
P1 (within 24h): Clients that contract this firm, or that depend on it through an energy or infrastructure provider, should confirm with the provider whether it has received a ransom demand or detected unauthorised access. Do not rely on the leak-site listing alone; it is a claim, not a confirmed incident. Where the provider cannot confirm or deny, treat the dependency as degraded and review any service-level or continuity arrangements that assume the provider is operating normally.
P1 (within 24h): Review third-party registers for any entry matching this provider and flag it for the next DORA Art. 28 review cycle. Confirm whether the provider appears in more than one business line, which would make it a concentration point under Art. 29.
P2 (within 72h): Where the provider is confirmed compromised, invoke contractual notification and audit rights under DORA Art. 30 and request the provider's incident timeline, affected systems and data categories. Do not accept a verbal assurance; ask for the written incident report.
P3 (within 7 days): Update the supply-chain risk assessment for the energy and infrastructure sector to reflect that engineering firms serving grid operators are now an active ransomware target set. This is a sector-level adjustment, not a response to a confirmed breach at any one client.
No vendor patch, version pin or configuration change applies, because the source names no product or vulnerability.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source contains no hashes, domains, IP addresses, file paths, registry keys or command lines. The only observable is the leak-site listing itself, which is a public claim and not a machine-pivotable indicator. Any IOC set for this incident would have to come from the victim or a first-party forensic report, neither of which is available.
6. Detection
Insufficient indicators to author detection rules.
The source provides no distinctive strings, command-line flags, mutex names, scheduled-task names, file paths, registry keys, ransom-note text or hard-coded values. A rule built on the group name or the victim name would detect reporting about the incident, not the incident itself, and is not emitted.
7. Sources
- Ransomware.live, "Victim: Company #110 – N0n", https://www.ransomware.live/id/Q29tcGFueSAjMTEwQE4wbg==, published 2026-10-23.
8. Adverse Trace position
Adverse Trace assesses this item as an unverified actor claim with no technical corroboration and no CVE, CVSS, EPSS or CISA KEV data to anchor a severity rating. The client impact is indirect: the victim is a supply-chain node for energy and infrastructure, not a financial entity, so the exposure reaches EMEA financial services through third-party dependency rather than direct compromise. We will monitor the N0n leak site for a change from pending exposure to published data, which would confirm the claim and allow a technical assessment, and we will reissue this advisory if a first-party report or victim statement becomes available. Clients should not treat the listing as a confirmed breach, but should use it to test whether this provider, or firms of this type, appear in their own third-party and concentration registers.
Published via PulseTrace — Adverse Trace threat intelligence.