Transcom WorldWide PayPal support operations targeted by N0n ransomware group

• Ransomware group: N0n
• Country: Sweden
• Sector: Financial Services
• Announcement date: September 18, 2026

The threat actor known as N0n has listed Transcom WorldWide on its leak site, claiming a significant data breach involving the organization's PayPal support operations. The announcement, made on September 18, 2026, alleges that the group has successfully compromised sensitive information and is exerting pressure on the organization through a ransom demand.

The details of the alleged attack

According to the claims made by the N0n group, the attack has caused significant disruption to the organization's operations. The threat actor states that they are currently enforcing a network blackout across all eight of Transcom WorldWide's sites. This type of operational disruption is a common tactic used in modern ransomware campaigns to maximize pressure on a victim.

The group has issued a specific ultimatum regarding the stolen data. The announcement claims that if a ransom payment is not received by September 21, 2026, the stolen information will be released to the public. This follows the pattern of double extortion, a common ransomware strategy where attackers not only encrypt an organization's systems but also steal sensitive data to threaten its public disclosure, thereby increasing the likelihood of payment.

Claimed data types and scope

The N0n group claims to have exfiltrated a massive volume of data, specifically alleging the theft of 86.7 million daily support-agent session records. The scope of the alleged breach extends beyond simple records to include critical infrastructure details that could compromise the organization's long-term security. The specific data types claimed to be in the possession of the attackers include:

• Connection records
• Session data
• Infrastructure configuration data

Furthermore, the attackers claim to hold access data for corporate Citrix/AAA systems, internal Active Directory (AD) information, PKI details, Netskope/Zscaler tenant information, and a complete infrastructure map. The exposure of such detailed architectural information, including internal directory services and security tenant data, represents a severe risk to the integrity of the network.

About Transcom WorldWide

Transcom WorldWide is a Swedish-based multinational corporation that provides customer experience, technical support, and outsourced business services globally. The company manages customer service operations for businesses across various industries, acting as a vital link in the service delivery chain for many large-scale enterprises.

Risk assessment and industry implications

This alleged breach poses substantial risks to the organization's operational continuity and the security of its customer data. The purported exposure of infrastructure maps and system access credentials could weaken the organization's network security and potentially facilitate secondary attacks by providing a roadmap of the internal environment. Because the organization operates within the European Union, this incident may trigger significant legal and regulatory consequences, such as data breach notification requirements and administrative penalties under the General Data Protection Regulation (GDPR).

Additionally, the disclosure of customer support data could lead to severe downstream impacts, including identity theft and highly targeted phishing attempts against the individuals whose data is involved. In the financial services support sector, the sensitivity of session records and connection data is particularly high, as these often contain the context of financial interactions.

To defend against such threats, organizations in the outsourced service sector typically focus on hardening their network perimeters, implementing strict multi-factor authentication (MFA) across all systems, and maintaining rigorous monitoring of internal directory services like Active Directory. Robust segmentation of networks and regular auditing of third-party access points are also essential defensive measures to mitigate the impact of a potential breach. While public information regarding the N0n group remains limited, the scale of this claim highlights the ongoing evolution of ransomware threats targeting global service providers.