Epi du Rouergue listed on nova ransomware leak site

• Ransomware group: nova
• Country: France
• Sector: Agriculture and Food Production
• Announcement date: January 6, 2026

The French bakery and pastry chain Epi du Rouergue has been listed on the leak site of the ransomware group known as nova. The group announced the listing on January 6, 2026, claiming that they have successfully gained access to the organization's data.

The claim by nova

The announcement regarding Epi du Rouergue was made by the nova group on January 6, 2026. According to the group's claim, they have achieved unauthorized access to the organization's internal data. At this stage, the group has not provided any screenshots or specific data samples to substantiate their claims of a breach. Furthermore, public information regarding the activities and identity of the nova group remains limited, making it difficult to ascertain the full scope of their operations or their typical methods of attack.

In many modern ransomware campaigns, threat actors utilize a technique known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to publish stolen information on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of sensitive details. This tactic increases the pressure on organizations, as the threat of a data leak can cause significant reputational and legal consequences even if the organization can restore its systems from backups.

Information regarding the leaked data

Regarding the content of the alleged breach, there is no detailed information available concerning the nature of the data shared on the leak site. The announcement does not include any screenshots or specific descriptions of the files that the group claims to have acquired. Additionally, the listing names no specific data types.

About Epi du Rouergue

L'Epi du Rouergue is a bakery and pastry chain that operates within the Aveyron and Tarn regions of France. The company specializes in the production of breads, pastries, and traditional specialties from the Aveyron region. Since its founding in 1973, the organization has grown to employ approximately 250 people. The company maintains a significant local presence through 12 physical stores and a presence in over 80 markets.

Risk assessment and implications

The potential leakage of organizational data in a situation like this may lead to the exposure of personal information belonging to both employees and customers. Because the organization operates within France, a potential data breach could trigger legal proceedings under the General Data Protection Regulation (GDPR), which governs data privacy and protection within the European Union. Such regulatory scrutiny often follows incidents where personal data is compromised.

The unauthorized acquisition of data by third parties can create various secondary risks. These include the possibility of identity theft or the execution of targeted phishing attacks against the individuals whose information was stolen. Furthermore, the organization could face operational disruptions and significant reputational damage resulting from the breach.

Because there is insufficient evidence regarding the group's specific ransom demands or the exact methods used for data exfiltration, the overall risk level remains uncertain. Organizations in the food production and retail sectors can mitigate such risks by implementing robust defensive measures. These typically include maintaining offline backups, implementing multi-factor authentication, conducting regular security awareness training for employees, and ensuring that data encryption is applied to sensitive information both at rest and in transit. Continuous monitoring of network traffic can also help in detecting unauthorized access attempts before data exfiltration occurs.