N0n ransomware group lists Konnatus (usucapião legal services) on its leak site

• Ransomware group: N0n
• Country: Brazil
• Sector: Professional Services
• Announcement date: September 18, 2026

The Brazilian legal services firm Konnatus has been listed on the leak site of the threat actor group known as N0n. The announcement, which appeared on September 18, 2026, indicates a potential data breach involving the organization's internal systems.

The claimed attack and extortion attempt

According to the announcement made by the N0n group, the threat actors claim to have successfully gained access to the networks of Konnatus. This unauthorized access has allegedly allowed the group to obtain specific datasets belonging to the organization. The group has employed a double extortion tactic, a common method used by modern ransomware operators where data is not only encrypted but also stolen to be used as leverage.

The N0n group has stated its intention to publish the stolen data publicly if certain conditions are not met. Specifically, the announcement claims that if the ransom demand is not met, the collected data will be released on the leak site on September 20, 2026. No specific ransom demand amount was provided in the announcement.

Alleged data types and affected information

The threat actor group claims to have exfiltrated various types of sensitive information from the organization's infrastructure. The data allegedly includes application databases containing critical business information, such as the chart of accounts, income/outflow structures, and various account types. Furthermore, the group claims to have accessed user accounts that contain password hashes.

Based on the claims made by the N0n group, the following types of information are potentially affected:

• Financial data
• User account information
• Password hashes

Organization profile

Konnatus is a professional services firm based in Brazil. The firm specializes in real estate law and provides legal services related to usucapião, which is the process of the acquisition of property through adverse possession.

Risk assessment and industry implications

This incident poses a significant risk regarding the exposure of sensitive data within Konnatus. The potential compromise of password hashes is particularly concerning, as these can be used to facilitate identity theft or serve as a foundation for targeted phishing attacks against both the organization's employees and its clients. Such attacks often leverage stolen credentials to gain further access to secure environments or to deceive individuals into revealing more sensitive information.

From a regulatory perspective, the organization may face legal sanctions under Brazil's LGPD (Lei Geral de Proteção de Dados) due to this potential data security breach. Additionally, the disclosure of internal financial structures could result in damage to the firm's commercial reputation and may create opportunities for secondary extortion attempts by other threat actors.

In the professional services sector, maintaining robust cybersecurity posture is essential to protect client confidentiality. Organizations typically defend against such threats by implementing multi-factor authentication (MFA) to protect user accounts, maintaining regular offline backups to ensure data availability, and conducting regular network monitoring to detect unauthorized access. Information regarding the specific capabilities and background of the N0n group remains limited.