Threat Actor "Nocturne" Claims Data Breaches at Nike and Alcon A threat actor using the alias Nocturne has posted a dark web listing alleging the exfiltration of customer data from Nike and confidential records from ophthalmology and medical device company Alcon. Neither company has confirmed the incidents. For Nike, the actor claims a breach occurred in June 2026, involving millions of customer records estimated in the eight-figure range exclusively from 2026. The dataset, reportedly exceeding 40GB uncompressed, includes recent customer registrations and order records, packaged as CSV files in a 7z archive. A sample screenshot was provided as proof. This follows a separate claim in January 2026, when the WorldLeaks ransomware gang alleged the theft of 1.4TB of internal Nike data, including design, manufacturing, and factory files though that incident reportedly involved insider access rather than customer records. For Alcon, the breach is alleged to have taken place in May 2026, with the stolen data encompassing a broader range of information. The dataset reportedly includes user sign-up details for Alcon’s MARLO platform (names, addresses, phone numbers), Salesforce supplier data, internal conversation logs, order numbers, and source code for internal files. A shared sample CSV revealed fields such as customer hierarchy IDs, account groups, credit limits, SAP IDs, and geographic classification data. The actor claims Alcon initially engaged in negotiations, receiving data samples before allegedly backing out of a deal, prompting the public leak. A direct message in the post criticized Alcon for failing to disclose the breach to customers. As of now, neither Nike nor Alcon has confirmed unauthorized access to their systems, and the claims remain unverified. The scale of the alleged breaches particularly the 40GB+ dataset has prompted security teams to monitor the situation closely while awaiting official statements.

The California Office of the Attorney General reported that on November 16, 2021, Alcon Vision, LLC experienced a data breach on October 5, 2021, involving the inadvertent disclosure of limited patient information via email. The affected information included first and last names, device serial numbers, dates of implant, and treating physicians, but neither financial information nor Social Security numbers were involved.