A Middle Tennessee special-effects fluid maker showed up on a ransomware leak-site tracker Monday afternoon. Ransomware.live indexed a listing titled Froggys Fog as a claimed victim of the N0n group at 2026-10-19 19:22 UTC (about 3:22 p.m. ET Monday), with an estimated attack date of Oct. 19. The listing describes the victim as a "special-effects fog fluid manufacturer and distributor" in Tennessee. No data size or ransom amount appears on the tracker page we reviewed.
That description matches Froggy's Fog (froggysfog.com), which presents itself as a U.S. manufacturer of fog, haze, snow, bubble, and training-smoke fluids and also sells fog and effects machines. Trade-directory listings give a Columbia, Tennessee business address, and the company's shipping page says orders ship from a fulfillment facility in Mt. Pleasant, Tennessee. Its customers range from home haunters to theme parks, haunted attractions, clubs, and training centers. The Ransomware.live entry lists no website, though another tracker files the claim under froggysfog.com. We are treating the "Froggys Fog" listing as pointing to this company. The public site was up (HTTP 200) when we checked Tuesday morning.
What's claimed, and what's confirmed
Claimed: N0n's post says it holds the company's shipping and order-management database, including nightly backup copies from January 2026 to the present, an employee account directory for the company domain, and shipping-software and remote-access configuration for warehouse servers. It marks the listing "not paid, exposed." All of that is an actor assertion. A leak-site description is not proof of what was taken, whether any systems were encrypted, or whether the data is what the group says it is.
Not confirmed: As of Tuesday morning we found no statement from Froggy's Fog, no news report confirming an incident, and no regulator or state attorney-general notice. There is no confirmed encryption, no confirmed theft of customer or employee data, no reported shipping or production disruption, and no word on any payment. Treat this as a claim until the company says otherwise.
Why it matters to effects suppliers and the event businesses they serve
For special-effects, staging, and event-production suppliers, late October is the busiest stretch of the year. Haunted attractions, theme parks, venues, and touring crews depend on on-time fluid and machine orders, and the order desk is where the pressure lands. The systems N0n named (order management, shipping software, and remote access to warehouse machines) run that whole process. A small manufacturer can keep making product and still be unable to ship it.
The quickest harm after a listing is usually fraud, not encryption. Customers and dealers should expect "updated remittance details" emails, fake order confirmations or tracking links, invoice changes that look like they came from a supplier they know, and support calls asking for remote access to fix an "order problem." Venues, haunts, and production shops across Tennessee, Georgia, and the Southeast should verify any change to payment details or account access with a phone number they already have, not the one in the message.
Ask the practical question: if the order system and shipping software went dark during peak season, could you still take orders, print labels, and tell customers when product will arrive?
Clear takeaway
Use N0n's claim against Froggy's Fog as a peak-season continuity drill for manufacturers, distributors, and event-production suppliers. Lock down remote access to warehouse and shipping systems, keep order data backups you can actually restore, and call back on any payment or account change, whatever a leak site alleges.
Actions to take this week
- Inventory remote access to warehouse PCs, shipping stations, and servers. Remove tools nobody uses, put the rest behind MFA, and retire shared logins on the dock and order desk.
- Require MFA on email, e-commerce and order-management platforms, shipping-carrier accounts, and payment processors, starting with owners and anyone with admin or refund rights.
- Test a restore of your order and customer database from backup this month. Keep one copy that cannot be changed or deleted, and make sure backups aren't reachable with the same credentials as production.
- Build a manual fallback: a printed list of open orders, carrier account numbers, and a way to hand-write or batch-print labels if the shipping software is down.
- Make a call-back list for your bank, key dealers, and largest customers using numbers from contracts, and use it before changing any wire, ACH, or remittance detail.
- Write a one-page incident card: who leads, who calls your insurer and IT provider, and what you tell customers if orders stall.
Brotherly Technology helps manufacturers, distributors, and event-production SMBs across Rome, Northwest Georgia, Atlanta, Chattanooga, Tennessee, and the Southeast turn ransomware headlines into a short readiness review covering MFA, backups, remote access, and payment-change controls. If you want a second set of eyes before the next claim lands, give us a call.
Sources:
- Ransomware.live: Froggys Fog / N0n. Discovered 2026-10-19 19:22 UTC; est. attack date 2026-10-19; no website or data size listed; claim-level only.
- Froggy's Fog (froggysfog.com). Context: Tennessee fog and effects-fluid manufacturer; fulfillment facility in Mt. Pleasant, TN, per its shipping page. No incident acknowledgment cited here.