Uruguay's Punta Shopping added to Emperador

Punta Shopping, the Uruguayan commercial organization that manages a shopping center, was added to Emperador's leak site on Oct. 31, 2026, according to Brandefense ATLAS. The source places it in the construction sector and describes its activities as retail, commercial space leasing and services.

What cases appeared in Brazil, and how should they be read?

Brandefense reported that monitoring channels described 24 victims of The Gentlemen in a single day, including the Health Secretariat of the Brazilian state of Mato Grosso. The source also clarified that the private cases were unverified claims and does not present them as confirmed facts.

That distinction matters because the list mixes public claims with mentions that still lack independent verification. In other words, the reference to Mato Grosso appears within a stream of posts attributed to the actor, but the source does not treat it as a settled attribution.

What did the research on n0n show?

An analysis attributed to SOCRadar described compromise attempts against 23 organizations in 14 countries and said the documented cases depended on weak or stolen credentials, with no vulnerability exploitation observed in those cases. The same research added that the group carried out mass scanning of RDP and automated credential stuffing against FortiGate SSL-VPN portals.

For U.S. provider ChiBiTek, according to that research, a pool of residential SOCKS5 proxies running 15 threads was allegedly used to test username and password combinations against the remote portal. The pattern points to initial access based on weak or compromised authentication, rather than technical exploitation of flaws in the affected systems.

What cautions did ZeroFox raise about n0n's claims?

ZeroFox said n0n claimed data from at least 38 maritime and logistics organizations, but assessed that the material likely came from a shared provider rather than 38 separate intrusions. That reading also pointed to possible data reuse or access through a common vendor in that sector, which could inflate the apparent number of victims.

That warning changes how the actor's lists should be interpreted. A single database, or access shared by third parties, can create the appearance of scale without necessarily reflecting the true number of separate intrusions.

What scope did other reports attribute to n0n?

Crypto Briefing reported 93 organizations listed on n0n's leak site and cumulative demands of about $283.7 million, but separated that figure from the 23 organizations identified as confirmed targets by the research and said no ransom payments had been confirmed. That distinction between claims, confirmed targets and verified payments is key to avoiding a single tally that mixes different categories.