Hunter Neurology claims data leak by N0n ransomware group

• Ransomware group: N0n
• Country: Australia
• Sector: Healthcare
• Announcement date: October 13, 2026

N0n group claims data breach at Hunter Neurology

The ransomware group known as N0n has announced a data breach involving Hunter Neurology, a medical practice located in Australia. According to an announcement made on the group's leak site on October 13, 2026, the group claims to have exfiltrated sensitive information from the organization's systems.

The group alleges that the data was leaked and exposed as a direct result of non-payment. According to the claims made by N0n, the breach involved the unauthorized extraction of data from the practice's medical records system. This type of incident is characteristic of double extortion tactics, where threat actors not only encrypt an organization's data but also threaten to publish sensitive information on public leak sites to pressure the victim into paying a ransom.

Details of the allegedly stolen data

The information claimed to be stolen by the N0n group is extensive and includes a variety of sensitive medical and personal files. The group asserts that the exfiltrated data consists of several specific categories of information that could significantly impact patient privacy.

The specific items allegedly compromised include:

• Patient images and scans
• Patient letters and reports
• Laboratory results
• Patient records system files
• Medical records system backups
• Patient names
• Dates of birth
• Clinical data

The scale of the alleged theft is substantial, with the group claiming the leak includes 15,252 patient images and scans, 11,819 patient letters and reports, 439 laboratory results, 839 patient records system files, and four complete weekly backups of the medical records system. The group also claims that protected health information, such as patient names, dates of birth, and clinical data, has been compromised.

About Hunter Neurology

Hunter Neurology is a neurology clinic operating in New South Wales, Australia. The facility provides specialized medical services that focus on the diagnosis and treatment of various neurological conditions.

Potential impact and industry implications

This alleged leak may lead to significant complications regarding compliance with Australian healthcare regulations. The nature of the exfiltrated data, which includes highly personal medical information and clinical data, could facilitate identity theft and targeted phishing attacks against the affected individuals. Furthermore, the claim that complete weekly backups of the medical records system were taken poses serious risks to both data integrity and privacy.

Such an incident could increase the risk of secondary attacks against the organization. When sensitive backups are compromised, it provides attackers with a roadmap of the organization's data structure and historical information, which can be used to refine future exploitation attempts. Publicly available information regarding the specific activities and methods of the N0n group remains limited.

In the healthcare sector, organizations often face heightened risks due to the high value of medical records on the dark web. To defend against such threats, organizations typically implement defensive measures such as robust encryption for data at rest and in transit, multi-factor authentication (MFA) across all access points, and rigorous patch management to close vulnerabilities. Additionally, maintaining offline, immutable backups is a common strategy to ensure data can be restored without complying with ransom demands, though the theft of such backups remains a critical risk factor in modern ransomware campaigns.