Nova ransomware group lists novaevo+ / T.consulT on its leak site

• Ransomware group: Nova
• Country: Italy
• Sector: Technology
• Announcement date: May 8, 2025

The threat actor known as Nova has listed the Italian technology company T.consulT on its leak site. According to the announcement made on May 8, 2025, the group claims that 10 GB of data belonging to the organization has been compromised and is available for release.

The claimed attack event

The announcement by the Nova group indicates that the company was targeted in a cyberattack. While the specific methods used to gain access have not been disclosed, the group has officially listed T.consulT on their platform to claim responsibility for the incident. The claim suggests that the breach occurred on May 8, 2025, the same day the announcement was posted on the leak site.

Ransomware attacks involving leak sites often follow a pattern of double extortion. In these scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data. The threat of leaking this stolen information on a public forum is used as leverage to pressure the victim into paying a ransom. If the ransom is not met, the attackers proceed to publish the data, causing significant reputational and operational harm to the target.

Details of the alleged data leak

Regarding the content of the alleged breach, the Nova group has provided limited specifics. The group claims that the total volume of the data involved is 10 GB. However, no specific details regarding the exact content or the types of files contained within this 10 GB have been provided by the attackers.

The listing names no specific data types.

When analyzing such incidents, it is important to note that the lack of immediate detail from the threat actor is common during the early stages of a leak. Organizations often face significant challenges in determining the full scope of a breach until a thorough forensic investigation is completed. The presence of large volumes of data on a leak site typically necessitates a comprehensive review of network logs and data egress patterns to understand what was actually taken.

The organization profile

T.consulT is an Italian company specializing in technical documentation lifecycle management software for industrial sectors. The company develops a specialized software solution called Novaevo, which is designed to serve high-stakes industries, particularly the aerospace and defense sectors.

Potential implications and industry risks

The situation involving T.consulT may pose significant data privacy risks for the company's clients and business partners. Because the company is based in Italy, any confirmed data breaches could lead to legal sanctions under the General Data Protection Regulation (GDPR). The regulatory framework in Europe imposes strict requirements on how personal and sensitive data must be protected and reported.

Furthermore, the disclosure of sensitive technical data within the aerospace and defense sectors could have broader consequences. Such industries are critical components of national infrastructure, and the exposure of technical documentation could affect supply chain security. The potential for reputational damage is high when a provider of specialized industrial software is targeted.

Given the nature of the sectors served by T.consulT, the release of the alleged data could lead to secondary threats. These include targeted phishing attempts or further attacks aimed at the company's supply chain. Organizations operating in these highly regulated and sensitive sectors often implement defensive measures such as network segmentation, strict access controls, and continuous monitoring to mitigate these risks. If the alleged data is indeed published, the industry may observe an increase in highly tailored social engineering campaigns designed to exploit the leaked information.