PG Group (Pure Options) listed on N0n ransomware leak site

• Ransomware group: N0n
• Country: United States
• Sector: Financial Services
• Announcement date: October 13, 2026

N0n ransomware group claims data leak of PG Group (Pure Options)

The N0n ransomware group has claimed responsibility for a data breach targeting PG Group (Pure Options). According to an announcement made on the group's leak site, the organization's data has been exposed following a failed extortion attempt. The threat actor asserts that the data was released because the organization did not meet the ransom demands.

Details of the alleged attack

On October 13, 2026, the N0n group listed PG Group (Pure Options) on their dedicated leak site. The threat actor claims to have successfully breached the organization's digital infrastructure, gaining unauthorized access to critical internal resources. Specifically, the group asserts that they have obtained access to the company's directory database, various staff accounts, and sensitive financial documentation.

This type of incident is characteristic of double extortion tactics used by modern ransomware groups. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to leak private data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Alleged data types and contents

The information allegedly stolen by the N0n group is significant in scope, covering both technical credentials and sensitive corporate records. While no screenshots were provided by the attackers to verify the contents of the breach, the group claims to have acquired a variety of files. The alleged data includes:

• Password data for 577 accounts
• A working password corpus for staff and administrator accounts
• Payroll reports
• General ledgers
• Signed operating and lease agreements

The inclusion of administrative credentials and password corpora suggests a high level of access during the intrusion, which can be used to facilitate further lateral movement within a network or to conduct subsequent attacks.

Organization profile

PG Group (Pure Options) is a cannabis producer and retailer based in Michigan. The company operates in the cultivation, processing, and retail sale of medical and recreational cannabis products.

Potential impact and security implications

The exposure of this specific dataset carries significant risks for the organization. The theft of password data and staff account credentials significantly increases the risk of identity theft and targeted phishing attacks directed at the company's employees and administrators. Such attacks often leverage stolen credentials to bypass security measures or to trick employees into revealing further sensitive information.

Furthermore, the exposure of financial records, such as general ledgers and payroll reports, combined with signed operating and lease agreements, could potentially impact the organization's business operations and reputation. For a company operating in a regulated sector, such a breach may also lead to legal consequences under state-level privacy laws and regulations, given that the organization is based in the United States.

In response to such incidents, security professionals generally recommend that organizations undergo a thorough security audit of their systems to identify the root cause of the breach. Additionally, resetting all compromised passwords and implementing multi-factor authentication (MFA) are critical defensive steps to mitigate the risk of ongoing unauthorized access. Organizations in the financial and retail sectors are encouraged to maintain robust monitoring and incident response plans to address the complexities of data exfiltration and potential regulatory scrutiny.