Clop ransomware group lists NUOVACMM.COM on its leak site

• Ransomware group: Clop
• Country: Italy
• Announcement date: August 12, 2026

Clop claims data exfiltration from Nuova CMM

The Clop ransomware group has listed the Italian organization NUOVACMM.COM on its dedicated leak site. According to the announcement made on August 12, 2026, the threat actor group claims to have successfully carried out a cyberattack against the company, with the alleged intrusion occurring around August 5, 2026. This listing is a characteristic move in the double extortion tactic frequently employed by modern ransomware groups, where the attackers not only encrypt systems but also threaten to publish sensitive information to exert maximum pressure on the victim organization.

The group claims to have exfiltrated a significant volume of data, totaling approximately 279 GB. By publishing this information on their leak site, the Clop group is likely attempting to intimidate the organization into meeting their demands. While the listing confirms the group's intent to publicize the breach, no specific ransom demand has been disclosed in the announcement.

Alleged data types and contents

The information provided by the Clop group regarding the specific contents of the stolen data remains limited. While no screenshots were provided to verify the authenticity of the breach, the group claims that the stolen data includes several critical categories of information. The alleged exfiltration involves:

• Databases
• Project files
• Software installers

The presence of such diverse data types suggests a broad reach within the organization's digital environment. Such a breach can have wide-ranging implications for the target's internal operations and external relationships.

About Nuova CMM

Nuova CMM is an industrial company based in Italy. The organization specializes in the fields of metalworking and laser cutting, and is involved in the production of precision mechanical components. They provide high-tech metal processing solutions designed for various industrial sectors, making them a specialized player in the manufacturing and industrial technology landscape.

Impact and security considerations

This incident poses significant risks to the organization's operational continuity and the security of its intellectual property. The claim that databases were part of the exfiltrated data is particularly concerning, as such information can lead to identity theft or facilitate highly targeted phishing attacks against the company's employees and its customer base. Furthermore, because the organization is based in Italy, this incident may trigger legal obligations regarding data breach notifications and could potentially result in administrative fines under the General Data Protection Regulation (GDPR).

From a technical perspective, the history of the Clop group suggests a pattern of exploiting vulnerabilities in file transfer software. Consequently, the possibility that this attack was executed via a supply chain compromise should be carefully considered. For organizations operating in similar industrial sectors, maintaining robust security postures is essential. This includes implementing strict access controls, monitoring for unauthorized data transfers, and ensuring that all software, especially those used for file transfers, is patched against known vulnerabilities. Strengthening supply chain security and preparing for regulatory compliance requirements are also vital steps for mitigating the long-term impact of such targeted cyber threats.