Story ·

Amagi Media Labs: an extortion claim, what is confirmed and what is only claimed

On 22 October 2026, Amagi Media Labs, a listed Bengaluru company whose software runs TV channels and streaming ad delivery, told the stock exchanges that a criminal is trying to extort it. Here is what Amagi has confirmed, what a ransomware group’s listing says, and what nobody knows yet.

By Threat Atlas India · Published 22 October 2026 · This story will be updated if Amagi tells the exchanges more.

The short version

  • Confirmed by Amagi: a threat actor claims to have taken “operational and network configuration data” relating to some of its systems, and is threatening to publish it unless it is paid.
  • Amagi says: it is checking the claim, including samples the attacker sent. It has hired outside security experts and lawyers and has told the authorities. It reports no disruption to its services, no evidence of impact on customer operations, and no expected material financial impact.
  • Claimed elsewhere: a ransomware group called N0n has an Amagi listing that says it holds network and device configuration files and internal network maps from a US broadcast playout site. This is the group’s word only.
  • Not claimed anywhere we have seen: customer personal data, video content or passwords.
  • Not known yet: whether the data is real, which systems it came from, and whether the listing and Amagi’s filing describe the same attack.

Claimed versus confirmed

These come from two different sources, four days apart. Amagi’s filing does not name the group, so the link between them is ours, from the company name, and Amagi has not confirmed it.

Claimed by a ransomware group 18 Oct The group N0n lists Amagi Media Labs on its leak site, according to the tracker ransomware.live. The listing describes “network and device configuration files from a US broadcast playout site” and “internal network maps of the site”. It shows no deadline and no proof we could check.
Confirmed by Amagi 22 Oct Amagi tells the exchanges, under Regulation 30 of SEBI’s listing rules, that it “has become aware of an extortion attempt” over “operational and network configuration data”. It is validating the samples the attacker shared.

A playout site is where a channel’s programmes and adverts are assembled and sent out. The listing says the data is from a US site. It does not say whether that site belongs to Amagi or to one of its customers.

How it unfolded

  1. The listing. Ransomware.live records the N0n listing for Amagi Media Labs, with the attack date estimated as 18 October. That is 3:54 am on 19 October in India.
  2. Amagi tells investors. It files a notice with the NSE and BSE titled “Claim relating to exfiltration of operational/network configuration data”, signed by its compliance officer.
  3. Shares dip. Amagi’s stock fell by up to about 2.6% in trade, according to inkl’s report of the day.
  4. Checking the claim. Amagi says it is validating the samples with outside experts and will tell the exchanges of any material development.

Who is Amagi, and who is N0n?

Amagi

Amagi Media Labs is based in Bengaluru and sells cloud software for broadcasters and streaming services, such as playing out channels and placing adverts. It listed on the exchanges earlier this year. NDTV is among its customers, though nothing suggests NDTV is involved in this incident.

N0n

Ransomware.live has tracked the group since mid-September 2026. It lists 147 victims in 34 countries, 45 of them in the United States, and one other Indian organisation. It does not say whether the group encrypts files, steals them, or both.

Threat Atlas India names an organisation only when it has confirmed an incident itself. Amagi did, in its own exchange filing. We do not name other organisations that appear only in criminals’ claims.

Why configuration files matter

Amagi has not said what is in the files, and the listing describes them only as configuration data and network maps. That kind of data usually holds no customer records or video. It can show an attacker how a network is laid out, which devices are on it and how they are set up. Such files sometimes also contain passwords or access keys, but nobody has said these do. That is our reading of what the data type could mean, not something Amagi or the group has stated.

What to do

  1. If you are an Amagi customer: ask Amagi in writing whether any of your sites’ configuration data was in the samples, and what you should change.
  2. Rotate shared secrets: change passwords, remote-access keys and SNMP community strings that were set up through Amagi or are used on playout equipment. Do it whether or not you are told it is needed.
  3. Check what is exposed: review firewall rules and remote access to broadcast and playout equipment, and turn off anything you do not use.
  4. Expect phishing: be wary of emails or calls that mention the incident and ask you to log in or share details.
  5. If you are an investor: wait for further exchange filings. Amagi says it does not expect a material financial impact at this stage.

What we don’t know yet

  • Whether the stolen data is real and, if so, what is in it.
  • Which systems it came from, and whether the US site belongs to Amagi or a customer.
  • Whether the N0n listing and Amagi’s filing are the same incident.
  • When Amagi first learned of the claim. The listing is four days older than the filing.
  • Whether any data has been published, and whether any customer is affected.

This story sticks to Amagi’s own filing and named sources. It will be updated if Amagi says more.

Sources

Spotted an error? Write to [email protected]. See the method and corrections.

More stories

Breaches · 22 October 2026Railway’s security disclosure: what to rotate, and whyRailway, a platform developers use to run their apps, says an attacker may have read customers’ stored secrets. What it says happened, what is still unknown, and what to rotate.
Breaches · 21 October 2026SBI's dark web leak: what is confirmed, and what is only claimedState Bank of India says 3,897 customer records were found in a dataset of about 3.75 lakh records on the dark web. What the bank confirmed, what the seller claimed, what the rules require, and what customers should do.
Supply chain · 22 October 2026LiteLLM 1.107.0: a trusted AI library shipped a password stealerA widely used open-source AI library had a release that steals credentials and opens a back door. What LiteLLM says happened, how to check if you were hit, and what to rotate.
All stories →