Dediserve Ltd listed on N0n ransomware leak site

• Ransomware group: N0n
• Country: United Kingdom
• Sector: Technology
• Announcement date: September 28, 2026

The threat actor known as N0n has listed Dediserve Ltd on its leak site, claiming to possess sensitive company data. The announcement, made on September 28, 2026, suggests a significant breach targeting the infrastructure of the technology provider. While the listing is a claim made by the threat actor, it indicates a potential exposure of data belonging to the organization and its various clients.

The claimed attack and event details

According to the claims made by the N0n group, the attackers gained access to infrastructure data specifically located within Dediserve Ltd's FRA1 data center. The group alleges that they have successfully obtained records pertaining to 167 tenant accounts, alongside various server disk images. This breach, which the group claims occurred on September 28, 2026, suggests that the attackers were able to penetrate the environment to extract significant amounts of information.

Furthermore, the threat actor alleges that the breach extends beyond simple account records. The group claims to be in possession of the provider's internal operations mailbox and critical monitoring configurations. Such access to internal communications and system monitoring tools typically indicates a high level of access within a target network, potentially allowing attackers to observe internal processes or maintain persistence.

Data allegedly involved in the breach

The information claimed to be stolen by the N0n group is diverse, covering various aspects of the organization's operations and its clients' services. The listed data types include:

• Customer records
• Infrastructure details
• Payment gateway configurations
• Trading-account records
• Password vault data
• Internal operational emails

The scope of the claimed data is broad, encompassing not just general infrastructure details but also highly sensitive information. This includes disk images from a forex broker portal, systems belonging to a payment service provider, and data from a production real-estate platform. The presence of a password vault and internal operational emails further highlights the potential sensitivity of the information the group claims to hold.

Organization profile

Dediserve is a technology company operating under the iomart Group. The company provides cloud infrastructure and managed hosting services, offering scalable cloud servers and enterprise-grade infrastructure solutions to its clients.

Risk assessment and industry implications

This incident may pose a significant risk of data exposure for Dediserve Ltd's clients. Because the claimed data includes information belonging to forex brokers and payment service providers, there is an increased risk of secondary malicious activities, such as financial fraud and identity theft. Additionally, since the company is based in the United Kingdom, this incident may involve potential violations of UK GDPR data protection obligations.

The fact that the servers may have been paused suggests a possible disruption in operational continuity, which can have negative implications for corporate reputation. In the context of ransomware and leak sites, threat actors often use a