The LiveRamp breach claim appeared on the N0n extortion group’s leak site on 11 November 2026. Although the listing alleges exposure of substantial identity and audience datasets, there is currently no independent evidence that LiveRamp was compromised.
Third-party monitors have confirmed that the listing existed, but this proves only that N0n published the allegation. LiveRamp had not confirmed or denied an incident as of 11 November 2026, and reputable researchers had not published screenshots, sample data or technical proof supporting the claim.
What the LiveRamp breach claim alleges
The first identified public record of the allegation was a ransomware.live crawler entry discovered on 11 November 2026. It reproduced text from a N0n leak site post naming LiveRamp as a victim and describing data that the group claimed to have exposed.
According to the mirrored listing, N0n claims to possess 39,055 identity-graph feed files totalling 2.2 TB. The files are described as being dated October 2026 and associated with identity resolution and data collaboration activities.
The group also alleges that it obtained 1,006 client-audience delivery files totalling 220.5 GB. These were described as covering purchase, over-the-top media, demographic and predictive audience segments.
A further allegation concerns 19.2 million hashed email identities. The listing claims these could be resolved to named individuals, while also referring to device-refinement feeds and daily compliance opt-out feeds. None of those descriptions or quantities has been validated by LiveRamp or an independent forensic source.
The post reportedly labelled the material as not paid and exposed, but did not provide a ransom demand. It also supplied no confirmed date of intrusion. Consequently, 11 November 2026 should be treated as the date the LiveRamp breach claim became public, not as the date of any alleged compromise or data theft.
What monitors have actually verified
More than one leak site monitor reproduced the N0n listing and its descriptive text. This corroborates the appearance of the post on the criminal group’s site, but the mirrors appear to derive from the same underlying actor statement.
No reputable third party has published downloadable samples, screenshots or other evidence demonstrating access to LiveRamp systems. There are also no victim-specific file hashes, malicious domains, file paths, ransom notes or forensic indicators available publicly.
LiveRamp’s press and news page contained no statement addressing the allegation as of 11 November 2026. Relevant status pages also showed no security incident linked to the claim, although the absence of a status notice cannot establish that a breach did not occur.
Products, versions and customers potentially affected
The N0n post refers broadly to identity-graph feeds and client-audience delivery files. It does not identify a named LiveRamp product, software version, tenant, hosting environment, integration or configuration.
There is therefore no verified basis for identifying affected products or versions. It is also unclear whether the alleged files, if genuine, came from LiveRamp infrastructure, a customer environment, a partner integration or another source with access to related data.
The LiveRamp breach claim may concern organisations that use LiveRamp directly, as well as advertisers, agencies and technology partners that exchange audiences through connected platforms. However, no customer list has been independently authenticated, and no specific UK organisation has been publicly confirmed as affected.
The references to files dated October 2026 do not prove when they were created, accessed or removed. They are descriptions supplied by N0n and should not be interpreted as a verified incident timeline.
N0n activity and possible attack methods
N0n is described by open source researchers as a recently observed data extortion operation active since September 2026. Reporting on the group indicates a focus on stealing data and applying pressure through threatened publication, sometimes accompanied by destructive activity, rather than relying solely on conventional file encryption.
Group-level research has discussed credential-based access and automation after researchers examined an exposed operator workspace associated with N0n. Reported techniques include credential stuffing against remote access appliances, use of valid cloud credentials, data exfiltration and, in some cases, destructive deletion.
These findings provide context about N0n, but they do not establish how the alleged LiveRamp breach claim arose. No vulnerability, compromised account, phishing campaign, malware family or entry point has been connected publicly to LiveRamp.
An IP address, 185.157.161.148, has been cited in research into infrastructure associated with an exposed N0n operator workspace. Trackers also attribute the Tor address nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion to the group’s leak site. Both are group-level intelligence, not proof of activity inside LiveRamp or its customers, and the Tor site should be treated as hostile.
Current exploitation status
Exploitation against LiveRamp remains unverified. The only confirmed event is the publication and subsequent monitoring of the N0n listing on 11 November 2026.
No proof of concept or tooling specific to LiveRamp has been reported. There is also no established compromise date, affected service or victim-specific attack chain that defenders can use to reconstruct the alleged incident.
Caution is particularly important with new leak sites. Researchers documented fabricated victim listings and bogus data from the separate 0APT operation earlier in 2026. That history illustrates why criminal posts require corroboration, but it is not evidence that N0n fabricated this particular LiveRamp breach claim.
Why the LiveRamp breach claim matters
If authentic, the alleged datasets could have implications beyond a single supplier because identity and audience platforms connect multiple organisations. Hashed email addresses are pseudonymised rather than necessarily anonymous, and their sensitivity depends on the surrounding data and whether records can be linked back to individuals.
For UK small and mid-sized businesses, the immediate issue is uncertainty. Organisations may use LiveRamp indirectly through advertising platforms, agencies or data partners without operating a direct technical integration.
Actions for organisations using LiveRamp
Responses should remain proportionate while confirmation is sought. Organisations should avoid treating the criminal listing as proof, but they should establish whether their data or integrations could fall within the categories described.
- Request written confirmation from LiveRamp or the relevant adtech provider about whether the allegation affects your organisation, identifiers or audience datasets.
- Identify direct and indirect LiveRamp integrations, including those managed by agencies, campaign platforms and data partners.
- Review recent third-party access, audience exports, cloud credentials and unusual data transfers connected to those integrations.
- Monitor criminal forums and N0n reporting for references to your brand, audience names or distinctive dataset descriptions.
- Preserve relevant logs and contractual contacts so the organisation can respond quickly if credible evidence or a vendor notification emerges.
The LiveRamp breach claim should remain classified as unconfirmed unless LiveRamp, a regulator or independent investigators provide reliable corroboration. Monitoring and vendor engagement are justified, but public conclusions about a breach or affected customers would currently go beyond the available evidence.
Originally reported by redpacketsecurity.com.
