Fanatics, the licensed sports merchandise and commerce platform, appeared on the leak site of N0n — a group that emerged in September 2026 and that ransomware trackers classify as a data broker rather than a conventional ransomware operation — with a claim dated 20 September covering 46,902 order files totalling 108 GB said to contain customer personal data, accounts-payable invoices for league and brand partners, customer balances and a bank transaction archive, customer tax-exemption certificates and the fraud-prevention data set, posted alongside a deadline of 23 September 2026. The listing carries no intrusion method and no ransomware note, which is consistent with the broker pattern of claiming exfiltration without encryption. Fanatics has made no statement and no regulator notification is visible, so the claim stands on the leak-site post alone; the same group listed the United Federation of Teachers and Prefix Corp on 18 September. Applying the breach triage this digest uses for major claims: there is no victim or regulator disclosure, no circulating sample has been structurally examined, and a high-volume listing from a group with an unestablished track record is the weakest evidentiary class — a dataset is claimed to be circulating, which is several steps short of the subject's systems having been compromised. Treat the volume figures as the operator's negotiating position.

• Source article