Nova ransomware group lists grupopuma on its leak site

• Ransomware group: Nova
• Country: Spain
• Sector: Manufacturing
• Announcement date: December 9, 2025

Nova ransomware group claims attack on Grupo Puma

The ransomware group known as Nova has officially listed the Spanish-based company Grupo Puma on its leak site. According to the announcement made on December 9, 2025, the threat actors claim to have successfully executed an attack against the organization, resulting in a data breach. This listing serves as a public claim by the group regarding the compromise of corporate information.

The incident was announced on the group's leak site, where the threat actors detailed the nature of their alleged intrusion. While the specific details regarding the volume of data stolen or the exact amount of the ransom demand remain unknown, the group has publicly identified the target and the nature of the breach.

Details of the alleged data breach

The Nova group has made specific claims regarding the types of information they have allegedly obtained during their operation against Grupo Puma. The threat actors assert that the breach involves access to sensitive internal information that could impact the company's digital infrastructure and administrative security.

According to the claims published by the group, the compromised information includes the following categories:

• Local folders
• Program credentials
• Databases

The presence of program credentials in the hands of threat actors is particularly concerning, as such information can often be used to facilitate further unauthorized access to a network. The claims suggest that the breach is not limited to simple file theft but extends to the core data structures and authentication mechanisms used by the organization.

About Grupo Puma

Grupo Puma is a prominent company based in Spain that operates within the manufacturing and construction sectors. The firm provides a wide range of specialized products essential for the construction industry, including mortars, adhesives, insulation systems, and various coating materials.

The organization maintains a global presence, delivering comprehensive construction solutions to a diverse client base. Their services and products are utilized across both public and private sector projects, making them a significant player in the international construction supply chain.

Impact and security implications

This incident poses significant risks to Grupo Puma, potentially impacting both its operational continuity and its corporate reputation. The alleged compromise of databases and credentials represents a serious threat to the organization's overall network security. Such a breach can serve as a gateway for secondary attacks, as stolen credentials can be leveraged to move laterally through a network or to escalate privileges.

Furthermore, because Grupo Puma operates within Spain, the company may face specific legal and regulatory challenges. The breach may trigger data protection obligations under the General Data Protection Regulation (GDPR), which could lead to potential administrative sanctions if compliance requirements are not met. The exposure of sensitive data often results in heightened scrutiny from regulatory bodies.

While information regarding the specific tactics of the Nova group remains limited, the situation highlights a common trend in modern cybercrime. Many ransomware groups employ double-extortion tactics, where they not only encrypt a victim's systems but also steal sensitive data to use as leverage. In such scenarios, even if a company can restore its systems from backups, the threat of leaking sensitive information remains. This stolen data might be utilized in future targeted phishing campaigns or even for corporate espionage activities. To mitigate such risks, organizations in the manufacturing and construction sectors often focus on strengthening their perimeter defenses, implementing multi-factor authentication to protect credentials, and maintaining rigorous data encryption protocols to ensure that even if data is exfiltrated, it remains unusable to unauthorized parties.