Epi du Rouergue Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The Epi du Rouergue bakery chain was listed on a leak site associated with the nova ransomware group on 6 January 2026. Public records show only that internal files were claimed to have been exfiltrated during a ransomware incident; the number of people affected and the precise contents of any data remain undisclosed.

Breaking down the breach

The incident was reported solely through the appearance of Epi du Rouergue on a site maintained by the nova group. No independent confirmation of the intrusion, the volume of data taken, or the timeline of events has been made public. The listing states that internal files were removed, yet provides no further detail on file types, encryption status, or whether any material was subsequently published.

Inside nova

Nova is a ransomware operation that maintains a public leak site to list organisations it claims to have compromised. Such groups typically gain initial access through phishing, exposed remote services or supply-chain weaknesses, then move laterally to locate and copy data before deploying encryption. The listing of Epi du Rouergue constitutes the group’s claim of involvement; no separate evidence has been released to corroborate that claim.

About Epi du Rouergue

Epi du Rouergue operates twelve stores across the Tarn and Aveyron departments and supplies more than eighty markets in south-western France. Founded in 1973, the business produces fresh bread, pastries, cakes and regional specialities without using freezing processes and employs approximately 250 people. As a regional food retailer it maintains records typical of any mid-sized employer and supplier, including customer orders, staff administration and commercial arrangements with local producers.

What was likely exposed

The only confirmed element from the listing is the exfiltration of internal files. Exact categories of data have not been disclosed. Organisations of this type commonly store employee records, supplier contracts, point-of-sale transaction logs and limited customer contact information; whether any of these categories were among the files removed is unconfirmed.

Why it matters

Exposure of internal files can reveal operational details that affect day-to-day business continuity and the privacy of staff or trading partners. Until the contents are verified or the organisation issues a statement, the practical consequences for individuals remain unknown. The absence of a reported figure for affected people indicates that the scale of any personal-data exposure has not yet been established.

Were you affected?

Individuals who have interacted with Epi du Rouergue stores or markets have no confirmed public channel to determine whether their information was included. Checking statements issued by the company and monitoring official notifications from data-protection authorities remain the primary steps. Running a free exposure scan of an email address against known breach repositories can indicate whether the address has appeared in previously published data sets, though it cannot confirm involvement in this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.