VX Case listed on nova ransomware leak site

• Ransomware group: nova
• Country: Brazil
• Sector: Retail & E-Commerce
• Announcement date: March 29, 2026

The ransomware group known as nova has listed the Brazilian e-commerce company VX Case on its leak site. Through this announcement, the threat actors claim to have successfully targeted the organization and obtained access to its internal systems, alleging that sensitive information has been exfiltrated.

The alleged attack and claims by nova

According to an announcement published on March 29, 2026, the nova group claims to have targeted VX Case. The group alleges that it has gained unauthorized access to the company's systems and has subsequently exfiltrated sensitive data. This type of activity is characteristic of modern ransomware operations, where attackers move beyond simple encryption to focus on data theft.

The threat actors have stated that they have provided a 10-day deadline for the company to contact them. This ultimatum is intended to pressure the organization into negotiating to recover the stolen data and to prevent the group from releasing further information or leaks to the public. This tactic is a hallmark of double extortion, a method where attackers demand payment not just to decrypt files, but to prevent the public exposure of stolen sensitive information.

Alleged data types involved in the breach

While the group has provided screenshots, the content of these images has not been verified. The information provided by the attackers suggests that the breach involves a variety of sensitive categories. The alleged data includes:

• WhatsApp conversations
• Customer information
• Customer photos
• Employee information

The specific volume of the data and the exact number of files involved have not been disclosed by the group. Additionally, no specific ransom demand has been made public in the current announcement.

Organization profile

VX Case is a Brazil-based e-commerce company. The organization specializes in the retail sector, specifically focusing on the sale of cases, screen protectors, and various other accessories designed for smartphones and various electronic devices.

Implications and organizational risks

Public information regarding the nova group remains limited, making it difficult to assess the full scope of their operations. However, if the claims made by the group are verified, the exposure of such diverse datasets—including personal customer details and internal communications—could pose significant risks. Specifically, the theft of customer and employee information can lead to increased risks of identity theft and the execution of highly targeted phishing attacks against the individuals involved.

From a regulatory perspective, the breach of personal data protection obligations may lead to administrative and legal consequences for the organization under the LGPD regulations in Brazil. Such legal frameworks are designed to ensure that organizations maintain strict standards for data privacy and security.

The use of the double extortion method by the attackers presents a significant threat to the company's operational continuity and can result in substantial reputational damage. For organizations operating in the retail and e-commerce sectors, such incidents highlight the importance of robust defensive measures. Common industry practices to mitigate these risks include implementing strong access controls, maintaining regular offline backups, and conducting thorough employee training to recognize social engineering attempts. Furthermore, organizations often focus on monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws to minimize the impact of potential breaches.