BeLi Teacher / FSC education centers (AWS) targeted by N0n ransomware group

• Ransomware group: N0n
• Country: Vietnam
• Sector: Education
• Announcement date: September 18, 2026

N0n group claims data breach at BeLi Teacher / FSC education centers (AWS)

The threat actor known as N0n has published an announcement on its leak site claiming to have successfully exfiltrated sensitive information belonging to BeLi Teacher / FSC education centers (AWS). According to the post, which was announced on September 18, 2026, the group has targeted the organization, which operates in the education sector and is based in Vietnam.

The claim involves a significant volume of data, with the threat actor asserting that 152,044 records have been compromised. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In these scenarios, threat actors do not merely encrypt an organization's systems but also steal sensitive data to use as leverage, threatening to publish the information on public leak sites if a ransom demand is not met.

Details of the alleged attack and extortion attempt

The N0n group has posted a specific claim targeting BeLi Teacher / FSC education centers (AWS). The threat actor alleges that the compromised data was migrated from the GetFly CRM system. This indicates that the attackers may have focused their efforts on customer relationship management infrastructure to maximize the impact of the breach.

The group has issued a direct threat regarding the stolen information. The post states that if the required payment is not made, the stolen data will be released to the public in batches. While the specific ransom demand has not been disclosed, the threat of a staggered release is a common tactic used by ransomware groups to increase pressure on the victim organization.

Scope of the alleged data exfiltration

The information allegedly stolen by N0n is extensive and includes various types of sensitive customer and operational data. The threat actor claims to have obtained 152,044 CRM contact records. These records reportedly contain a variety of personal and professional details, including names, email addresses, phone numbers (specifically +84 numbers), cities, study interests, and engagement history.

Beyond simple contact details, the breach allegedly includes broader CRM archive files. The data said to be involved includes:

• Customer contact information
• CRM records
• Customer engagement history

Furthermore, the group claims to have access to CRM archive files that contain tasks, forum discussions, comments, and various customer files, representing a deep dive into the organization's internal communications and client interactions.

Potential impact and organizational risks

This alleged breach poses a significant risk to the privacy of the organization's customer data. The exposure of such a wide range of information, including study interests and engagement history, creates opportunities for malicious actors to conduct highly targeted phishing attacks or identity theft attempts against the affected customers. When attackers possess specific details about a person's interests and previous interactions, they can craft much more convincing social engineering messages.

For an organization based in Vietnam, such an incident may present significant challenges regarding compliance with local data protection regulations. Furthermore, the exposure of CRM data can lead to substantial damage to operational processes and can severely harm established customer relationships. The loss of trust resulting from such a breach often has long-term consequences for educational institutions.

While information regarding the N0n group remains limited, this incident highlights the ongoing risks faced by the education sector. Organizations can mitigate such risks by implementing robust security measures, such as multi-factor authentication, regular data backups, and continuous monitoring of their CRM and cloud environments. Protecting sensitive customer information is vital for maintaining operational integrity and regulatory compliance.