ARRCO LSM listed on nova ransomware leak site

• Ransomware group: nova
• Country: Norway
• Sector: Professional Services
• Announcement date: April 28, 2025

ARRCO LSM targeted by nova ransomware group

The professional services firm ARRCO LSM has been listed on the leak site of the ransomware group known as nova. According to the announcement made on the group's platform, the organization has been targeted in a cyberattack involving data exfiltration and system encryption.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption occurs. The attackers then threaten to publish this stolen data on a public leak site if a ransom is not paid. This method places immense pressure on organizations, as the threat of a public data breach can cause significant reputational and legal damage, even if the organization can restore its systems from backups.

Details of the claimed attack

The nova group claims to have leaked data belonging to ARRCO LSM on its leak site. Based on the information provided in the group's post, the organization's systems were reportedly encrypted on April 15, 2025. Following the encryption of the systems, the group asserts that the data was leaked on April 24, 2025. The announcement was officially posted to the leak site on April 28, 2025.

In their communication, the group asserts that it has published the organization's data. Notably, the group has utilized critical language directed at the organization's business partners within their announcement. While the group has taken responsibility for the leak, information regarding this specific group remains limited in the public domain.

Data involved in the leak

The post indicates a total data size of 5 GB. However, no specific details regarding the nature of the data or the specific file types involved have been provided by the attackers. The listing names no specific data types.

When dealing with large volumes of exfiltrated data, organizations face significant challenges in determining the exact scope of the breach. Determining what was taken often requires extensive forensic investigation to map the attacker's movements within the network. Without specific details from the threat actor, the full extent of the compromise remains uncertain.

Impact and organizational implications

This incident may lead to disruptions in the organization's operational continuity and a loss of commercial reputation. Although the content of the allegedly leaked data remains unclear, given that the organization operates in the professional services sector, it is possible that customer data or sensitive business processes could be at risk.

Because the organization is based in Norway, the incident may trigger data breach notification obligations under the General Data Protection Regulation (GDPR). Organizations operating within the European Economic Area must adhere to strict protocols regarding the reporting of personal data breaches to regulatory authorities and, in certain cases, to the affected individuals.

Furthermore, there is a possibility that the leaked data could be utilized for secondary attacks or targeted phishing campaigns. Once data is available in the public domain, it can be used by other threat actors to craft highly convincing social engineering attacks against employees or clients. To defend against such threats, organizations typically implement multi-factor authentication, maintain offline backups, and conduct regular security awareness training for staff to recognize phishing attempts.