N0n ransomware group lists FinSoft (Kolibri retail back-office software) on its leak site

• Ransomware group: N0n
• Country: Uzbekistan
• Sector: Retail & E-Commerce
• Announcement date: September 22, 2026

FinSoft targeted by N0n ransomware group

The Uzbekistan-based technology company FinSoft has been listed on the N0n ransomware group's leak site. The threat actor claims that the company's business operations have been halted and that backups have been encrypted or destroyed. This incident, announced on September 22, 2026, marks a significant potential breach for a key provider in the regional retail technology sector.

Claims made by the N0n group

According to the announcement made by the N0n group on September 22, 2026, the organization is facing severe operational disruptions. The threat actors claim that the company's business operations have been halted as a direct result of the attack. Furthermore, the group alleges that the company's backups have been either encrypted or destroyed, a common tactic used in modern ransomware attacks to increase pressure on the victim.

The group has issued a deadline, stating that if no payment is made by September 25, 2026, they will proceed with a phased publication of data. The threat actor has specifically threatened to release customer databases belonging to more than 10 retail chains if their demands are not met. Ransomware leak sites like the one used by N0n are often used in double extortion schemes, where attackers not only encrypt data to disrupt operations but also threaten to leak sensitive information to coerce the victim into paying a ransom.

Data allegedly involved in the breach

The information allegedly stolen by the N0n group is extensive and covers various critical business functions. The group claims to have access to data belonging to over 10 retail chains, which includes sensitive operational and customer information. The alleged data includes:

• Sales records
• Stock data
• Pricing information
• Financial records
• Customer databases
• API service data

The inclusion of API service data and back-office platform data suggests that the breach may impact the technical infrastructure used by the company's clients to manage their daily business activities.

About FinSoft

FinSoft is an Uzbekistan-based technology company that provides back-office software solutions and IT services for the retail sector under the Kolibri brand. The company offers platform and API services to various retail chains for sales, inventory management, pricing, and financial record tracking.

Impact and industry implications

This incident may lead to operational disruptions for the retail chains served by FinSoft. The potential leakage of customer data could increase the risk of identity theft and targeted phishing attacks for the customers of the affected retail chains. Additionally, the exposure of trade secrets belonging to these chains may negatively impact their competitive advantage.

The progression of this event may highlight the importance of supply chain security. When a software provider that manages critical functions like inventory, pricing, and financial records is compromised, the impact extends far beyond the initial victim to all downstream clients. This type of incident can necessitate that the affected retail chains review their data protection compliance processes and strengthen their third-party risk management frameworks.

While public information regarding the N0n group is limited, the nature of this claim underscores the growing risk posed by ransomware groups targeting specialized software providers. Organizations in the retail and e-commerce sectors should prioritize robust backup strategies, ensure that API connections are strictly monitored, and implement comprehensive vendor risk assessments to mitigate the potential impact of such supply chain vulnerabilities.