N0n ransomware group lists TapClicks (marketing analytics platform) on its leak site

• Ransomware group: N0n
• Country: United States
• Sector: Technology
• Announcement date: September 25, 2026

Marketing analytics platform TapClicks listed by N0n

The marketing analytics platform TapClicks has been listed on the leak site of the threat actor group known as N0n. The group has made claims regarding a significant data breach involving the organization, asserting that they have successfully obtained internal information from the company's systems.

Claims of unauthorized access and deadlines

The N0n group has listed TapClicks on their dedicated leak site, claiming to have obtained internal data from the organization. According to the threat actor, the breach includes access to the organization's source code, instance management systems, and customer databases. This type of activity is characteristic of double extortion tactics, where attackers not only encrypt data but also threaten to leak sensitive information to pressure the victim into paying a ransom.

In their announcement, the group has set a deadline for the organization, stating that the matter must be addressed by 2026-09-28. While the specific nature of the ransom demand remains unknown, the threat of publicizing sensitive data is a primary driver in these extortion-based attacks.

Alleged data types and scope of the leak

The leaked data is alleged to include a wide variety of sensitive information that could impact both the organization and its clients. The threat actor claims to have access to the following types of data:

• Source code
• Multi-tenant management system architecture
• 354 advertising platform datasets
• Client lists
• User accounts with password hashes
• Ad-platform connection credentials

The volume of the data is described as over 97,000 commits, though the exact size of the total data package has not been specified. The presence of password hashes and connection credentials suggests a high level of access to the internal infrastructure.

About TapClicks

TapClicks is a SaaS platform that provides data analytics, reporting, and business intelligence solutions for marketing teams. The company offers performance tracking and automation services by centralizing advertising and marketing data.

Potential risks and industry implications

This incident may pose risks of identity theft and account takeover for clients utilizing the TapClicks platform. The alleged exposure of ad-platform credentials could facilitate secondary attacks on third-party services, potentially expanding the scope of the breach beyond the initial target. Given that the organization is based in the United States, state-level data protection regulations and potential legal obligations may apply following such an event.

Information regarding the N0n group remains limited, making it difficult to attribute the attack to a specific known entity or to understand their long-term motivations. Furthermore, the potential exposure of source code might simplify the discovery of future vulnerabilities, which could increase supply chain risks for all users of the platform. When source code is leaked, it provides a roadmap for attackers to study the application's logic and identify flaws that were previously hidden.

For organizations operating in the technology and SaaS sectors, such incidents highlight the importance of robust security measures. Common defensive steps include implementing multi-factor authentication to mitigate the risk of account takeover, utilizing strong encryption for data at rest and in transit, and maintaining rigorous patch management to close vulnerabilities. Additionally, monitoring for unauthorized access to sensitive management systems and implementing strict access controls for multi-tenant architectures are critical components of a modern security posture. Organizations should also be prepared to comply with regional data protection laws and maintain incident response plans to manage the legal and operational fallout of a potential breach.