BRDSoft Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 21 October 2025, the ransomware group known as nova listed BRDSoft on its leak site, claiming the company as a victim of a ransomware attack in which internal files were exfiltrated. Public detail remains limited: the number of people affected is unknown, and no further technical specifics about the intrusion have been confirmed. The listing itself is an unverified claim by the group. For an IT and telecommunications provider that supports call centres, hosting firms, data centres and internet service providers, any confirmed compromise of internal material carries potential consequences for both the company and the organisations that rely on its services.

What is known so far rests solely on the group's public listing and the accompanying description of the victim. No independent confirmation of the scale, exact timing of the intrusion, or full scope of data access has been released. This article sets out the available facts, places them in context, and outlines the practical implications for anyone who may have been affected.

Inside the incident

According to the listing published by nova, BRDSoft was the target of a ransomware attack that involved the exfiltration of internal files. The report date associated with the listing is 21 October 2025. Beyond that single claim, public information is sparse. The number of individuals whose data may have been involved is listed as unknown. No statement from BRDSoft confirming or denying the incident has been incorporated into the available record, and no technical indicators—such as the initial access vector, the duration of the attackers' presence, or the volume of data taken—have been disclosed.

Ransomware operations of this type typically combine encryption of systems with theft of data, followed by a threat to publish the stolen material if a ransom is not paid. In this case the only concrete assertion is that internal files were removed. Whether encryption also occurred, whether systems were restored from backups, or whether negotiations took place remains unconfirmed. Readers should treat the leak-site entry as a claim rather than as independently verified fact until further evidence emerges.

Inside nova

Nova is a ransomware group that has appeared in public reporting as an actor that encrypts victim networks and exfiltrates data before listing organisations on a dedicated leak site. Like many such groups, it relies on the dual pressure of operational disruption and the threat of data publication to encourage payment. Public analyses of its activity describe a model in which affiliates or operators gain access, move laterally, steal files, and then deploy ransomware. The group has previously been associated with listings of companies across multiple sectors, though each individual claim must be evaluated separately.

In the present case, nova's listing of BRDSoft is simply that—a listing. No additional statements from the group about this specific victim, such as sample file dumps, ransom demands, or deadlines, are part of the factual record provided. Established patterns of the group's behaviour supply useful background for understanding the claim, but they do not substitute for confirmation that the attack against BRDSoft occurred exactly as described.

About BRDSoft

BRDSoft is described as an IT and telecommunications company that supplies solutions to telecommunications providers, call centres, hosting companies, data centres and internet service providers. Organisations of this type typically design, implement and maintain infrastructure and software that keep communications and hosting services running. Their work often involves privileged access to client networks, configuration data, support systems and internal operational records.

Because BRDSoft sits in the middle of multiple service chains, a breach of its own systems can create secondary risk for the companies that depend on it. Even without confirmed client data exposure, the compromise of internal files can reveal network diagrams, credentials, support procedures or commercial information that adversaries might later reuse. The company's sector therefore makes any credible claim of intrusion consequential, regardless of the still-unknown scale of the event.

What data was at risk

The only data category named in the available facts is "internal files exfiltrated in ransomware attack." No further breakdown—such as employee records, customer databases, source code, credentials or financial documents—has been disclosed. Public detail on the precise contents is therefore limited.

Companies that provide IT and telecommunications support commonly hold configuration files, administrative credentials, client contact information, service contracts, internal correspondence and technical documentation. Any of these could fall under the broad label of "internal files." Until a verified inventory is released, however, it is not possible to state with certainty which categories were taken or whether personal data of individuals was included. The absence of a confirmed count of affected people reinforces that the exact exposure remains unconfirmed.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details, credentials or other personal data if those elements were present. Even partial records can enable phishing, social-engineering attempts or identity-related fraud. Because the number of people affected is unknown, the breadth of any such risk cannot yet be measured.

For BRDSoft itself, the stakes include operational disruption, the cost of investigation and recovery, possible contractual or regulatory obligations to notify clients, and reputational damage arising from the public claim. Downstream customers—telecommunications firms, call centres, hosting providers and ISPs—may need to reassess any shared credentials, review access logs, and monitor for anomalous activity that could stem from material taken from BRDSoft. None of these consequences has been confirmed as having materialised; they represent the ordinary range of outcomes that follow a claimed ransomware incident involving internal files.

Were you affected?

If you are an employee, contractor or client of BRDSoft, or if you have reason to believe your data may have been stored in its systems, begin by monitoring official statements from the company. Change passwords for any accounts that may have been linked to BRDSoft services, enable multi-factor authentication where available, and remain alert for unexpected messages that reference the company or request sensitive information. Keep records of any suspicious contact.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Such a scan will not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant attention. Continue to treat the nova listing as an unverified claim until more definitive information is released.

AICompiled with AI assistance from public sources and published under our editorial standards.