Tomio Ingeniería listed on nova ransomware leak site

• Ransomware group: nova
• Country: Argentina
• Sector: Manufacturing
• Announcement date: April 28, 2025

Argentinian engineering firm targeted by nova ransomware group

The Argentina-based manufacturing firm Tomio Ingeniería has been listed on the leak site associated with the ransomware group known as nova. The threat actor claims to have successfully breached the organization's systems, leading to a significant data leak involving the company's operational information.

Details of the claimed attack and data leak

According to the information provided in the leak site listing, the attack unfolded in several stages. The threat actor, identified as nova, claims that the organization's systems were encrypted on March 22, 2025. Following the initial encryption of the systems, the group states that the stolen data was subsequently published on April 9, 2025. The group suggests that they have gained access to the organization's operational data during the course of the intrusion.

Regarding the specifics of the information exfiltrated during the breach, the listing provides limited details. While the exact content of the leaked files remains unknown, the group has specified the scale of the theft. The total size of the data claimed to have been stolen is 10 GB. The listing does not provide a specific file count or any detailed information regarding the exact nature of the files contained within this volume.

About Tomio Ingeniería

Tomio Ingeniería is an engineering and construction firm based in Argentina. The company provides specialized services in several critical industrial fields, including industrial facilities, infrastructure projects, and mechanical installations.

Impact assessment and security implications

This incident may lead to a disruption of the organization's operational continuity and the exposure of sensitive commercial information. The publication of such data may increase the risk of identity theft or targeted phishing attacks directed at employees and business partners. Furthermore, the organization may face legal obligations under data protection regulations in Argentina due to the exposure of its data.

General context of ransomware and double extortion

This incident follows a pattern often seen in modern ransomware attacks, specifically a tactic known as double extortion. In these scenarios, threat actors do not simply encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The attackers then use the threat of leaking this data on public sites to pressure the victim into paying a ransom. This approach ensures that even if an organization can restore its systems from backups, the threat of public exposure remains a significant lever for the criminals.

Defensive considerations for the manufacturing sector

For organizations operating in the engineering and manufacturing sectors, such incidents highlight the importance of robust cybersecurity postures. When a breach occurs, it is often advisable for the organization to initiate a forensic investigation to determine the full scope of the leak and identify the initial point of entry. Such investigations are critical for understanding whether the breach was limited to specific servers or if it has spread throughout the entire network infrastructure.

To mitigate the risks associated with such attacks, organizations often implement various defensive layers. These include regular offline backups to ensure operational continuity, strict access controls to limit the movement of attackers within a network, and continuous monitoring of network traffic to detect unusual data exfiltration patterns. Because information about groups like nova is often limited in the public domain, organizations must remain vigilant against evolving tactics used by these threat actors.

• Forensic investigation to determine the scope of the leak
• Monitoring for potential phishing attacks
• Compliance with local data protection regulations