STOKR (digital securities platform) Listed by N0n Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group has publicly listed STOKR, a Luxembourg-based digital securities platform, on its leak site and described investor and staff-related material it says it will release if no settlement is reached. Nothing in the public record confirms that a breach occurred, that any files left the company, or that the described datasets exist as claimed. For people who have used platforms like this—investors who completed identity checks, or staff with internal accounts—the practical stake is straightforward: if sensitive records were copied, they could be misused for fraud, targeted phishing, or unwanted contact with tax or identity details. As of writing, STOKR has not publicly confirmed the claim.

What is known so far is limited to the listing itself, the date it was reported, and the group’s own description of what it says it holds. Scale, method of access, and whether any data has actually been published remain undisclosed in the material provided for this article. Readers should treat the claims as unverified until the company, a regulator, or another independent source confirms them.

Inside the listing

According to the available record, STOKR was listed by the N0n ransomware group, with the listing reported on September 18, 2026. The organization is described as a digital securities / investment platform based in Luxembourg in the EU. The number of people affected is unknown. Specific technical details—how access was supposedly obtained, when any intrusion is said to have occurred, and whether any ransom demand figure was stated—are not disclosed in the facts at hand.

The group’s listing text describes material it says will be published if no settlement is reached. That description includes what it calls a KYC investor register (full names, emails, countries, nationalities, wallet addresses and tax IDs where present), identity-to-crypto-wallet mapping of KYC-accepted investors (with countries including FR, DE, CH, BE, NL, UK and others mentioned), and an internal platform admin directory with staff accounts and roles. The same listing text also states that investor data would be delivered to the tax authorities of the investors’ countries. These points are the group’s claims on its leak site, not an independently verified inventory. Public detail does not establish that any of this material was taken or will be released.

The group behind it: N0n

N0n is known in public reporting as a ransomware and extortion-style actor that uses leak-site pressure: victims are named, sample claims or file descriptions are posted, and a countdown or threat of publication is used to push for payment. Like other groups in this category, N0n’s public posts are marketing and coercion tools. Listings can exaggerate scope, recycle older material, or name organizations that later deny any incident. Nothing about N0n’s general pattern proves that any particular claim about STOKR is accurate.

For this listing, only what appears in the reported summary should be attributed to the group: it claims to hold KYC-related investor data and staff directory material and threatens publication and delivery to tax authorities if no settlement is reached. No further statements by N0n about this victim are established in the facts provided.

STOKR (digital securities platform) and its sector

STOKR operates in the digital securities space—platforms that help issue, distribute, or manage tokenized or digitally represented investment products and that often sit at the intersection of capital markets rules, investor onboarding, and crypto-adjacent wallet infrastructure. Firms in this sector typically serve cross-border investors and must collect identity and compliance information under KYC and anti-money-laundering expectations common in the EU and elsewhere.

A credible incident affecting such a platform would matter because the same systems that support legitimate investing often concentrate high-value personal and financial identifiers in one place. That does not mean STOKR was breached; it explains why a leak-site claim aimed at this type of business draws attention. Luxembourg’s role as a European funds and financial-services hub adds regulatory and cross-border context, but again does not confirm any loss of data.

The information in question

Named data types in the sense of a confirmed exposure are not disclosed as verified fact. The only descriptions available are those in the N0n listing text summarized above. Those descriptions should be read as the group’s unverified marketing of what it says it will publish.

If files of the kind claimed were taken from a digital securities or investment platform, organizations in this sector typically hold investor identity and contact details, nationality and country information, tax identifiers where required, wallet or account references linked to onboarding, and internal staff directories with roles and access labels. Whether any such records were copied from STOKR, and in what form, remains unconfirmed. Readers should not assume their own file is in any dump solely because a group named the company.

Why it matters

If investor KYC-style data were genuinely exfiltrated, real-world risks would include targeted phishing that references real names, countries, or wallet activity; account-takeover attempts against email or exchange-related services; and fraud that misuses tax IDs or identity documents. Mapping identity to wallet addresses, if accurate, could also support more precise social engineering or unwanted scrutiny. Staff directory data, if real, could aid spear-phishing against employees or impersonation of internal roles.

The listing’s claim that data would be sent to tax authorities is likewise unverified. Even as a threat, it illustrates how extortion crews mix financial pressure with fear of regulatory or legal exposure. For the organization, an unconfirmed public accusation still creates reputational and operational noise: customers seek clarity, partners ask questions, and trust depends on transparent communication when facts are established. None of that proves negligence or confirms theft; a leak-site entry alone does not establish what happened inside the company.

What a listing does establish is narrow: a named group chose to associate STOKR with a ransom narrative on a given reported date and published a description of datasets it wants victims and readers to believe are at risk. What it does not establish is intrusion, exfiltration, file authenticity, or publication.

If your data was involved

If you onboarded with STOKR or a similar platform and are concerned the claims could affect you, proceed on a conditional basis. Watch for unexpected emails, messages, or calls that cite your investments, KYC status, wallets, or tax details; verify any request through official channels you already trust rather than links or contacts supplied in an unsolicited message. Consider strengthening passwords and multi-factor authentication on email and financial accounts, and be cautious about sharing additional identity documents in response to pressure. If you later receive clear notice from the company or a regulator, follow that guidance and use official fraud-reporting routes in your country where appropriate.

You can also run a free exposure scan of your email to check whether your information has already surfaced in known breach data, which may help you prioritize monitoring even when a specific incident remains unconfirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.