NOVEXCO Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 21, 2023, the Canadian office-supplies distributor NOVEXCO was listed by the alphv ransomware group, which claimed to have exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and public detail on the precise scope and contents of the incident is limited.

The listing itself is an unverified claim by the group. For customers, employees, and business partners of a national distributor that handles workplace supply chains and client relationships, any confirmed exposure of internal material carries practical consequences that warrant careful attention rather than alarm.

What happened

According to the available record, NOVEXCO appeared on alphv’s leak site on or around September 21, 2023. The group asserted that internal files had been taken during a ransomware attack. No confirmed figure for the volume of data, no list of specific file categories beyond the general description “internal files,” and no independent verification of the claim have been publicly detailed in the facts at hand. Timing of the intrusion itself, the initial access method, and whether a ransom was demanded or paid are undisclosed.

In short, the incident is known principally through the threat actor’s listing. Organisations in this position commonly face pressure from double-extortion tactics—encryption of systems paired with a threat to publish stolen data—but those operational details specific to NOVEXCO have not been confirmed in the public record summarised here.

Who is alphv?

Alphv, also widely known as BlackCat, is a ransomware-as-a-service operation that emerged in late 2021 and became one of the more prominent English- and Russian-speaking ransomware groups of the following years. It typically recruits affiliates who conduct intrusions, then provides the encryptor and leak-site infrastructure in exchange for a share of any ransom. The group is noted for using a Rust-based payload, for targeting a wide range of sectors, and for practising double extortion: data is stolen before systems are encrypted, and the stolen material is threatened with publication if payment is not made.

Alphv has been linked to numerous high-profile incidents across North America and Europe. Its leak site serves both as a pressure mechanism and as a public claim of responsibility. In the present case, the listing of NOVEXCO should be read as the group’s assertion; it does not by itself constitute independent confirmation that the claimed exfiltration occurred or that any particular files were taken.

About NOVEXCO

NOVEXCO describes itself as the largest Canadian-owned national distributor of office supplies and services. Its stated mission centres on providing innovative business solutions for the workplace and on maintaining the satisfaction and loyalty of its various client groups. As a national distributor, the company sits between manufacturers and a broad base of commercial, institutional, and possibly governmental customers across Canada, handling product catalogues, ordering systems, logistics, and account relationships.

Organisations of this type routinely maintain internal records that can include customer account details, pricing and contract information, employee data, supplier agreements, inventory and shipping records, and internal correspondence. A breach affecting such a distributor is consequential because the data often touches multiple third parties—clients who rely on the supply chain, employees, and business partners—rather than a single consumer population.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of the files, no confirmation of personal data elements, and no count of affected individuals have been disclosed. Exact contents therefore remain unconfirmed.

Companies in the office-supply distribution sector typically hold a mix of operational and relationship data. Without confirmation, it is not possible to state that any specific category was taken; the following are simply the kinds of material such an organisation would normally possess:

• Customer and account records, including business contact details and order histories
• Employee and contractor information used for payroll, benefits, or internal administration
• Supplier contracts, pricing schedules, and logistics data
• Internal correspondence, financial working papers, and operational documents

Until NOVEXCO or an independent investigation provides a clearer accounting, any assumption about precise data types would be speculative.

Why it matters

For individuals whose information may have been among the internal files, the practical risks include targeted phishing that references real business relationships, attempts to socially engineer access to related accounts, and, if identity or financial details were present, longer-term fraud concerns. Because the number of people affected is unknown and the data types are not itemised, the scale of personal impact cannot yet be measured.

For the organisation, a claimed ransomware incident raises operational, contractual, and reputational questions: potential disruption to order fulfilment, notification obligations to clients and regulators, and the need to verify whether any published material authenticates the group’s claim. Even when encryption is reversed or systems are restored, the existence of an exfiltration claim can require sustained monitoring and customer communication. None of these outcomes imply established negligence; they are simply the ordinary consequences that follow a publicly listed ransomware event.

What to do if you're exposed

If you are a customer, employee, or partner of NOVEXCO and believe your information may have been involved, begin with measured steps. Monitor account statements and business email for unusual activity. Treat unsolicited messages that reference office-supply orders, invoices, or internal contacts with caution, and verify them through known channels. Consider placing fraud alerts with credit bureaus if you have reason to think personal identifiers were included. Keep records of any suspicious contact.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not confirm or deny involvement in this specific incident, but it can indicate whether your address is circulating more widely and help you prioritise password changes and multi-factor authentication on important accounts. Further official statements from NOVEXCO, if issued, should be read carefully for any concrete guidance on notification or support.

AICompiled with AI assistance from public sources and published under our editorial standards.