MCAP — MortgageHub commercial lending platform targeted by N0n ransomware group

• Ransomware group: N0n
• Country: Canada
• Sector: Financial Services
• Announcement date: September 30, 2026

N0n ransomware group claims breach of MCAP — MortgageHub

The threat actor group known as N0n has listed data allegedly belonging to the MCAP — MortgageHub commercial lending platform on their leak site. This announcement, made on September 30, 2026, marks a significant potential security incident for the Canadian financial services sector. The group's claim involves a massive collection of sensitive information that could impact both individual borrowers and corporate entities.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The goal is to pressure the victim into paying a ransom by threatening to publish the stolen information on a public leak site. This method increases the leverage held by the attacker, as the threat of a data leak can cause irreparable reputational damage and legal consequences, even if the organization can restore its systems from backups.

Details of the alleged attack and extortion attempt

According to the claims made by the N0n group, the breach occurred on September 30, 2026. The threat actors assert that they successfully gained unauthorized access to several critical components of the organization's infrastructure. Specifically, the group claims to have accessed the organization's borrower database and its commercial loan portfolio. Furthermore, the attackers claim to have compromised the platform's backup archive, which is a critical target in modern ransomware campaigns designed to prevent easy recovery.

The group has issued an ultimatum regarding the stolen information. The announcement states that if a ransom is not paid, the data will be published on their leak site after October 3, 2026. While the specific ransom demand was not disclosed in the announcement, the threat of public exposure remains a primary driver for extortion in these types of cyberattacks.

Alleged sensitive data and affected information

The data allegedly stolen by the N0n group is extensive and covers a wide range of sensitive personal and financial information. The group claims to possess seven years of borrower records, which provides a long-term view of the customers' financial behaviors. The information reportedly includes highly sensitive identifiers and financial details that are highly valued on illicit markets.

The following data types are reportedly involved:

• Social insurance numbers
• Dates of birth
• Full addresses
• Loan history
• Payment history
• Credit scores
• Insurer policy numbers

In addition to the personal information listed above, the group claims to have accessed the commercial mortgage portfolio, details regarding arrears, and investor reporting fields. The breadth of this data suggests a deep penetration into the platform's administrative and financial records.

About MCAP — MortgageHub

MCAP is a major Canadian financial services company that provides, manages, and securitizes residential and commercial mortgage loans. It operates its commercial lending processes and portfolio management through the MortgageHub platform. Given its role in the Canadian financial landscape, the platform serves as a critical hub for mortgage-related transactions and data management.

Implications and industry risks

This alleged breach may pose a significant data privacy risk for the financial services sector in Canada. The exposure of social insurance numbers and financial records could increase the risk of identity theft and fraud for affected individuals. When sensitive identifiers like social insurance numbers are compromised, they can be used by malicious actors to open fraudulent accounts or commit various forms of financial crimes.

Furthermore, the organization may face data breach notification obligations and potential legal sanctions under Canada's PIPEDA legislation. The disclosure of the commercial mortgage portfolio could lead to a loss of trust among corporate clients and investors. For financial institutions, maintaining the confidentiality of client portfolios is essential for market stability and client retention.

To defend against such threats, organizations in the financial sector typically implement a multi-layered security strategy. This includes robust access controls, continuous monitoring of network traffic, and regular security awareness training for employees. Additionally, protecting backup archives through immutable storage and implementing strict data encryption protocols are essential steps to mitigate the impact of both data exfiltration and encryption-based ransomware attacks.