Prafesta Ind. e Com. de Embalagens Ltda targeted by N0n ransomware group

• Ransomware group: N0n
• Country: Brazil
• Sector: Manufacturing
• Announcement date: October 16, 2026

Prafesta Ind. e Com. de Embalagens Ltda listed on N0n leak site

The Brazil-based packaging manufacturer Prafesta Ind. e Com. de Embalagens Ltda has been listed on the leak site of the ransomware group known as N0n. The threat actor claims to have gained access to sensitive data belonging to the organization and has threatened to release the information publicly if their demands are not met.

Details of the alleged attack

According to the announcement made by the N0n group, the incident occurred on October 16, 2026. The group claims to possess a variety of sensitive information belonging to the company and has indicated that, as of the time of the announcement, no payment has been made to the attackers. Information regarding the N0n group remains limited in the public domain.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This tactic is frequently part of a double-extortion strategy, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage. By threatening to leak the stolen information, the attackers aim to create reputational and regulatory pressure on the victim. If the ransom is not paid, the group typically proceeds with the public disclosure of the data to maximize the impact on the target organization.

Alleged compromised data types

The data allegedly compromised in this incident is extensive and covers various aspects of the company's operations, including human resources, financial management, and client interactions. The information claimed to be stolen includes:

• Payroll data
• Customer data
• Supplier data
• Identification numbers (CPF)
• Financial records
• Bank certificates

Specifically, the group claims to have obtained records from the Senior Sapiens ERP and the Vetorh HR payroll platforms. This includes eSocial government payroll filings for the months of September and October 2026. Furthermore, the breach allegedly involves electronic invoices containing both customer and supplier data, the CPF identification numbers of workers and business partners, as well as bank integration certificates and various financial records.

Organization profile

Prafesta Ind. e Com. de Embalagens Ltda is a Brazil-based packaging manufacturer and industrial company. The company specializes in plastic packaging solutions, particularly through extrusion processes.

Impact assessment and security implications

The nature of the data allegedly stolen poses significant risks to the organization and its stakeholders. The exposure of identification numbers, such as CPFs, increases the risk of identity theft for the company's employees and business partners. Additionally, the leakage of financial records and bank certificates may weaken the organization's supply chain security, potentially facilitating secondary fraud attempts by malicious actors.

From a regulatory perspective, such a breach could lead to administrative and legal sanctions under Brazil's LGPD (Lei Geral de Proteção de Dados) regulations. Furthermore, the exposure of eSocial data may create compliance issues with government authorities. Given the apparent use of double-extortion tactics by the N0n group, there is a possibility that the data could be subject to broader leaks in the future.

In the manufacturing sector, maintaining the integrity of supply chain data is critical. Organizations often implement defensive measures such as multi-factor authentication, regular security audits, and robust encryption for sensitive databases to mitigate these risks. Protecting ERP and HR platforms is particularly vital, as these systems hold the core operational and personal data of the workforce and the business's financial foundation.