LCM Construção e Comércio S/A listed on Nova ransomware leak site

• Ransomware group: Nova
• Country: Brazil
• Sector: Manufacturing
• Announcement date: July 11, 2025

A new data breach claim has emerged involving the Brazilian construction and engineering firm LCM Construção e Comércio S/A. The threat actor known as Nova has officially listed the organization on its dedicated leak site, claiming to have successfully targeted the company's digital infrastructure.

The claims made by Nova

According to the announcement posted on the Nova leak site, the threat actor claims to possess sensitive data belonging to LCM Construção e Comércio S/A. The group has indicated its intention to release the allegedly stolen information to the public. This type of announcement is a common tactic used by ransomware groups to exert pressure on their victims, often following a pattern known as double extortion.

In double extortion schemes, attackers do not merely encrypt a company's systems to disrupt operations; they also exfiltrate sensitive data. The threat of leaking this data serves as additional leverage to coerce the victim into paying a ransom. While the claim has been published, the specific details regarding the attack timeline and the exact nature of the breach remain subject to the group's assertions.

Details regarding the alleged data leak

Despite the public listing by the Nova group, there is currently a lack of granular information regarding the specific files or datasets that have been compromised. At this stage, no screenshots or detailed descriptions have been provided to substantiate the claim or to illustrate the specific types of information contained within the alleged breach.

The listing names no specific data types or categories of information that have been targeted or stolen.

About LCM Construção e Comércio S/A

LCM Construção e Comércio S/A is a prominent organization based in Brazil. The company operates extensively within the engineering and construction sectors. Its professional scope includes the management and execution of various infrastructure projects, road construction, and the provision of diverse engineering solutions to meet complex industrial and civil needs.

Potential implications and organizational risks

This incident may pose significant risks to the operational continuity and data privacy of LCM Construção e Comércio S/A. Depending on the actual content of the allegedly leaked data, the exposure of sensitive information belonging to employees or clients could potentially lead to identity theft and the execution of targeted phishing attacks against the organization's stakeholders.

Furthermore, the company may face significant legal obligations under Brazil's General Data Protection Law (LGPD). Such regulatory frameworks impose strict requirements on how organizations must protect personal data and how they must respond when a breach occurs. Beyond legal and regulatory scrutiny, the company may experience reputational damage and face increased scrutiny regarding the security of its supply chain.

General defensive considerations for the sector

While the specific motivations and methods of the Nova group remain uncertain due to limited public information, this incident highlights the ongoing risks faced by the manufacturing and construction sectors. Organizations in these sectors often manage complex supply chains and vast amounts of project-specific data, making them attractive targets for cybercriminals.

To mitigate such risks, organizations typically focus on several defensive pillars:

• Data Protection and Encryption: Implementing robust encryption for data at rest and in transit to ensure that even if data is exfiltrated, it remains unreadable to unauthorized parties.
• Access Control: Utilizing the principle of least privilege to ensure that users and processes only have access to the specific data required for their functions.
• Monitoring and Detection: Maintaining continuous visibility into network traffic and system logs to identify anomalous behavior that might indicate an ongoing exfiltration attempt.
• Incident Response Planning: Developing and regularly testing comprehensive response plans to ensure the organization can react effectively to both data breaches and ransomware encryption events.

As the situation regarding LCM Construção e Comércio S/A develops, the verification of these claims will be essential for understanding the true scope of the impact.