EnVision Eye Care targeted by N0n ransomware group

• Ransomware group: N0n
• Country: United States
• Sector: Healthcare
• Announcement date: October 16, 2026

N0n claims to have leaked EnVision Eye Care data

The threat actor known as N0n has claimed responsibility for a data breach involving EnVision Eye Care. According to an announcement made on the group's leak site on October 16, 2026, the group alleges that they have successfully compromised and listed sensitive information belonging to the healthcare provider.

The incident involves a claim of a data leak rather than a simple encryption event. The N0n group has stated that the stolen information would be released to the public if their ransom demands are not met. This approach is a hallmark of modern cyberattacks, where the threat of exposing sensitive information is used to exert maximum pressure on the victim organization.

Details of the alleged data breach

The information allegedly stolen by the N0n group is extensive and includes highly sensitive medical and personal identifiers. The group claims to have access to a significant volume of records, specifically targeting patient-related documentation. The alleged data includes the following:

• Patient names and dates of birth
• Patient database backups
• Eye examination records
• Medical and social history
• OCT eye scan archive

The claim suggests that the stolen data spans a significant timeframe, with patient database backups allegedly covering the period from 2018 through 2025. The inclusion of such a broad range of historical data indicates a potentially deep level of access into the organization's digital archives.

About EnVision Eye Care

EnVision Eye Care is an ophthalmology clinic located in the state of Mississippi, United States. The institution is dedicated to providing specialized eye examinations and various medical eye care services to its patient population. As a healthcare provider, the organization handles a vast amount of sensitive medical information as part of its daily operations.

Risks and industry implications

This alleged breach poses a high risk due to the exposure of Protected Health Information (PHI). Because the victim is a healthcare provider operating within the United States, the incident may lead to significant legal and administrative consequences under HIPAA regulations. The exposure of such data often triggers mandatory reporting requirements and regulatory scrutiny.

For the individuals whose data has been allegedly compromised, the risks extend beyond the immediate privacy violation. Patients may face secondary threats, such as identity theft and highly targeted phishing attacks, where attackers use specific medical or personal details to gain trust and extract further information.

The N0n group appears to be employing double-extortion tactics. In a double-extortion scenario, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage during negotiations. This tactic is designed to ensure that even if an organization can restore its systems from backups, they still face the threat of public data exposure.

While information regarding the specific identity and methods of the N0n group remains limited, the incident highlights the ongoing vulnerability of the healthcare sector. Organizations in this sector can take various defensive steps to mitigate such risks, including implementing robust encryption for data at rest and in transit, maintaining offline backups, and enforcing strict access controls to limit the movement of threat actors within the network. Such incidents can have lasting negative impacts on an organization's operational continuity and the trust established with their patients.