Universite de Pau et du Pays de lAdour targeted by nova ransomware group

• Ransomware group: nova
• Country: France
• Sector: Education
• Announcement date: September 29, 2025

Nova ransomware group claims data theft at Universite de Pau et du Pays de lAdour

The ransomware group known as nova has announced the alleged theft of 80GB of data belonging to Universite de Pau et du Pays de lAdour on their leak site. This announcement, which surfaced on September 29, 2025, marks a significant potential data breach for the French educational institution.

Details of the alleged attack and ransom demand

According to the announcement published by the nova group on September 29, 2025, the group claims to have exfiltrated 80GB of data from the systems of the Universite de Pau et du Pays de lAdour. The group has indicated that they are currently conducting a ransom process. This process is reportedly being carried out in exchange for the decryption and the deletion of the stolen data.

Ransomware attacks of this nature often involve a tactic known as double extortion. In such scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to leak the stolen data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. While the specific ransom demand amount was not disclosed in the announcement, the threat of data exposure remains the primary driver for the negotiation process.

Scope of the alleged data exfiltration

The data allegedly stolen by the nova group is described as being quite extensive, covering a wide range of institutional and personal information. The group claims that the exfiltrated files include various types of sensitive documentation. The alleged content includes:

• Documents and reports
• Billing PDFs and payment documents
• Plans and factory documents
• Full worker information
• Complete student and teacher data, including private IDs

The potential exposure of such a diverse dataset suggests a deep penetration into the university's digital infrastructure. The inclusion of private identification details for both students and faculty members significantly elevates the severity of the incident, as these identifiers are highly valuable for malicious activities.

About Universite de Pau et du Pays de lAdour

The Universite de Pau et du Pays de lAdour is a public university that was founded in 1972. The institution maintains several campuses located in Pau, Bayonne, Tarbes, and Mont-de-Marsan within France. Affiliated with the Academy of Bordeaux, the university is a significant academic entity that conducts a wide variety of education and research activities across numerous academic disciplines.

Security implications and potential risks

This incident may pose a significant risk to the privacy of student and staff data within the university. The personal data allegedly exfiltrated could potentially be used for identity theft or targeted phishing attacks against the individuals involved. Because the institution is located in France, it is likely that the incident will be assessed as a data protection breach under the General Data Protection Regulation (GDPR), which could potentially trigger legal consequences for the organization.

Furthermore, the exposure of financial documents may impact the institution's operational security and its overall reputation. For organizations in the education sector, such breaches can lead to a loss of trust among students, faculty, and partner organizations. While information about the nova group remains limited in the public domain, the impact of their actions can be profound.

To mitigate the risks associated with such attacks, organizations typically focus on strengthening their defensive posture. This includes implementing robust data encryption, maintaining rigorous access controls, and ensuring regular, offline backups are available. Additionally, continuous monitoring of network traffic and employee training regarding phishing awareness are common defensive steps used to identify and prevent unauthorized data exfiltration before it reaches a critical scale.