International Business Solution de México Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 6, 2026, the ransomware group nova listed IBS de México on its leak site, stating that internal files had been taken during a ransomware operation against the company. No information has been released on the number of individuals affected or the volume of data involved. The listing itself constitutes the primary public record of the event; independent confirmation of the exfiltration or subsequent use of the material has not been provided.

Inside the incident

The incident was reported on April 6, 2026, when nova added IBS de México to its data-leak platform. The group asserts that internal files were removed from the company’s systems as part of a ransomware attack. No further technical details—such as the specific ransomware variant, initial access method, or timeline of the intrusion—have been disclosed by either the company or the threat actor. The number of records or files involved remains unknown.

The group behind it: nova

Nova is a ransomware operation that maintains a public leak site where it lists organizations it claims to have compromised. Like other groups in this category, it typically combines encryption of victim systems with the threat of publishing stolen data if ransom demands are not met. The group’s listings are presented without independent verification, and the accuracy of any specific claim rests on the actor’s own statements. Nova has appeared in public reporting on multiple incidents involving commercial and industrial targets, though details of its infrastructure and membership are not publicly confirmed.

Who is IBS de México?

IBS de México operates in the digital-printing and packaging sector, providing commercial printing, flexography, offset printing, and digital-printing services. The company also offers marketing-logistics solutions through its LINK technology. Its client base includes organizations that rely on printed materials and flexible packaging for product labeling and distribution within Mexico. Entities in this sector routinely process order data, artwork files, shipping information, and contact details for business customers.

The information in question

The only data category named in connection with the incident is “internal files exfiltrated in ransomware attack.” No inventory of file types, no indication of whether personal data of employees or customers is present, and no confirmation of the total volume have been released. Organizations engaged in printing and packaging commonly retain production records, client specifications, and logistics data; however, whether any such material was among the files listed by nova is unconfirmed.

What's at stake

Until the contents of the exfiltrated files are clarified, the precise exposure risk to individuals or partner organizations cannot be quantified. If client or employee records are included, affected parties could face follow-on risks such as targeted phishing or misuse of business credentials. For IBS de México, the incident introduces the possibility of operational disruption from any encryption component and the need to manage communications with customers whose information may have been accessed.

If your data was in this claimed breach

Individuals who have conducted business with IBS de México should monitor their email and financial accounts for unusual activity and consider enabling multi-factor authentication on any services that share contact details with the company. Organizations that exchange production files or order data with the firm may wish to review access logs for those systems. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.