Ihara listed on nova ransomware leak site
Ihara, a manufacturing company based in Brazil, has been listed on the leak site of the threat group known as nova. The group claims to have obtained 70 GB of data belonging to the company.
- Published
- 2 min read
- 2 min read
- Ransomware group: nova
- Country: Brazil
- Sector: Manufacturing
- Announcement date: April 28, 2025
Ihara listed on nova ransomware leak site
The Brazilian manufacturing company Ihara has been listed on a leak site associated with the threat group known as nova. According to the announcement made by the group, a significant amount of data belonging to the organization has been compromised in a cyberattack.
Details of the claimed attack
The threat actor, identified as nova, has published a notice on its leak site claiming responsibility for the breach of Ihara. The group asserts that the initial encryption of the company's systems occurred on March 27, 2025. Following the encryption phase, the group claims that the stolen data was leaked on April 10, 2025. The announcement itself was officially posted on the leak site on April 28, 2025.
Information regarding the specific methods, motivations, or technical capabilities of the nova group remains limited in the public domain. Ransomware groups often utilize a tactic known as double extortion, where they not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data to use as leverage. By threatening to release this data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or sensitive information.
Data involved in the leak
The announcement provided by the threat group specifies the volume of the data involved in the incident, though it lacks granular detail. The group claims to have obtained a total of 70 GB of data belonging to Ihara. However, the listing does not provide specific details regarding the nature or the types of the data contained within this volume. The listing names no specific data types.
About Ihara
Ihara is a chemical company based in Brazil. The organization specializes in the agricultural sector, where it develops and manufactures various crop protection products. Their product portfolio includes essential agricultural tools such as herbicides, insecticides, and fungicides.
Impact and risk assessment
This alleged data leak poses potential risks to the company's operational continuity and its commercial reputation. While the specific contents of the 70 GB of data have not been clarified, the risk of exposure regarding employee or customer information cannot be ignored. Such breaches often lead to secondary threats, where stolen information is utilized in subsequent targeted phishing campaigns or other malicious activities.
From a regulatory perspective, the company may be required to fulfill specific data breach notification obligations under Brazil's LGPD regulations. For organizations operating in the manufacturing and chemical sectors, maintaining robust cybersecurity defenses is critical to protecting intellectual property and sensitive commercial data. Common defensive measures include implementing strict access controls, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access via phishing.
Summary of the incident
- Organization: Ihara
- Threat Group: nova
- Claimed attack date: March 27, 2025
- Claimed leak date: April 10, 2025
- Announcement date: April 28, 2025
- Claimed data size: 70 GB