National Institute of Materials Physics Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The National Institute of Materials Physics, a scientific research organization based in Bucharest, Romania, appeared on a listing associated with the nova ransomware group on November 23, 2025. The group claims to have carried out a ransomware attack involving the exfiltration of internal files, though the number of individuals affected remains unknown. This incident draws attention to the handling of research-related information at public scientific institutes, where data often supports ongoing studies with potential implications for academic collaboration and institutional operations.

Breaking down the breach

The only confirmed detail is the listing itself on November 23, 2025. No information has been released about the timing or method of the claimed intrusion, the volume of data involved, or whether any files were later published. The organization has not issued a public statement confirming or denying the claims, and the scale of any impact on individuals is stated as unknown.

Who is nova?

Nova is a ransomware group that publishes victim names on a leak site after encrypting systems and removing copies of files. The group follows a pattern seen with other ransomware operators: it asserts that data has been taken and uses the listing to apply pressure. The listing of the National Institute of Materials Physics constitutes the group's claim; no independent confirmation of the data removal has been made public.

About National Institute of Materials Physics

The National Institute of Materials Physics is a Romanian public research body located in Bucharest. Its work centers on fundamental and applied research in solid-state physics and materials science, including laboratory studies that generate experimental data, project documentation, and records of collaborations with other scientific institutions.

What data was at risk

The only data category named is internal files exfiltrated in a ransomware attack. The precise contents of those files have not been disclosed. Organizations of this type commonly maintain research datasets, grant records, personnel files, and correspondence; however, the exact composition of any material removed in this case remains unconfirmed.

The real-world impact

Exposure of internal research files could affect the confidentiality of ongoing projects and the privacy of staff or partners whose details appear in administrative records. For the institute, the incident adds to the workload of incident response, potential regulatory notifications, and restoration of systems. No evidence of subsequent misuse of specific records has been reported.

If your data was in this claimed breach

Individuals who have professional contact with the institute can review any recent correspondence for unusual activity and consider enabling additional authentication on accounts that may share email addresses or identifiers with the organization. A free exposure scan of an email address against known breach data can indicate whether information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.