novaevo+ / T.consulT Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target specialised software providers that sit inside complex industrial supply chains, turning operational tools into leverage for extortion. In this landscape, the listing of an Italian technical-documentation firm by a known ransomware actor fits a familiar pattern of claims that organisations must assess carefully against limited public detail.

On 8 May 2025 the ransomware group nova listed T.consulT, the developer of the Novaevo+ software suite, claiming that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and the precise contents of the material have not been independently confirmed. The incident matters because T.consulT’s products support documentation lifecycles in aerospace and defence environments, sectors where even limited exposure of internal material can raise operational and compliance concerns.

What happened

Public reporting indicates that the nova ransomware group added T.consulT, referenced alongside its Novaevo+ product, to its leak-site listings on or around 8 May 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access vector, the duration of unauthorised presence, the volume of data taken, or any ransom demand—have been disclosed in the available record. The number of individuals whose information may have been involved is listed as unknown. At present the listing itself constitutes an unverified claim by the threat actor; independent confirmation of the breach’s full scope has not been published.

The group behind it: nova

Nova is a ransomware operation that has appeared in public threat reporting as a group employing double-extortion tactics: encrypting systems while also claiming to steal data and threatening to publish it if payment is not made. Like many contemporary ransomware crews, nova maintains a leak site on which it posts victim names and, at times, sample files to increase pressure. The group’s public activity typically involves opportunistic or targeted intrusions against mid-sized organisations whose data or operational continuity can be leveraged. In the present case the group claims that T.consulT’s internal files were taken; no additional statements by nova specifically detailing this victim beyond the listing have been recorded in the facts available. Attribution of the listing remains a claim until corroborated by the organisation or independent investigators.

T.consulT and its sector

T.consulT is an Italian company that develops specialised software for managing the lifecycle of technical documentation. Its Novaevo+ solution is designed for industrial environments, with particular relevance to aerospace and defence programmes where rigorous document control, versioning, and compliance records are essential. Organisations of this type typically sit inside regulated supply chains; they hold design data, process specifications, supplier information, and internal project files that support certification and operational readiness. A breach affecting such a provider is consequential because the software and the documentation it manages can touch multiple downstream customers and partners. Even when the exact data set remains unconfirmed, the sector’s sensitivity means that any unauthorised access raises questions about continuity of documentation integrity and potential exposure of proprietary or controlled technical material.

The information in question

The available facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown—such as employee records, customer lists, source code, or specific technical drawings—has been named. Organisations that develop and support industrial documentation platforms commonly hold source repositories, configuration data, customer project files, internal correspondence, and administrative credentials. Whether any of those categories were among the material claimed by nova is unconfirmed. Public detail is therefore limited to the broad description of “internal files,” and readers should treat more granular assertions as speculative until additional verified information appears.

The real-world impact

For individuals whose personal or professional data may have been stored in T.consulT systems, the primary risks include potential misuse of contact details, credentials, or project-related identifiers if those elements were present. Because the scale of exposure is unknown, the concrete number of people who need to take action cannot yet be stated. For the organisation itself, the listing creates reputational pressure, possible contractual notifications to aerospace and defence clients, and the operational cost of investigating and containing any confirmed intrusion. In regulated sectors, even an unconfirmed claim can trigger audit and disclosure obligations. The absence of confirmed data types or affected counts means that impact assessments remain provisional; both the company and any partners must await clearer evidence before quantifying harm.

If your data was in this claimed breach

If you have a relationship with T.consulT or use Novaevo+ in a professional capacity, monitor official statements from the company for confirmation and guidance. Change passwords associated with any accounts that interact with the firm’s services, enable multi-factor authentication where available, and remain alert for unexpected communications that reference internal projects or documentation. Because the precise contents of the claimed exfiltration are unconfirmed, treat any unsolicited requests for further personal or technical information with caution. As a practical next step, you can run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets; such checks provide an early indicator while official details continue to emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.