Nuclebrás Equipamentos Pesados Listed by worldleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 13, 2025, the Brazilian state-owned company Nuclebrás Equipamentos Pesados was listed by the ransomware group worldleaks, which claimed to have carried out a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and public detail on the full scope is limited. For employees, contractors, partners, or others whose information may sit in those systems, the practical concern is straightforward: internal corporate files can contain personal identifiers, contact details, and work-related records that, once outside the organisation’s control, can be misused for fraud, phishing, or other harm.

Because the listing is a claim by the group rather than an independently confirmed disclosure by the company, the precise impact is still unclear. What is known is enough to warrant attention from anyone connected to Nuclebrás Equipamentos Pesados or its supply chain.

Inside the incident

Public reporting states that Nuclebrás Equipamentos Pesados was listed by the worldleaks ransomware group on March 13, 2025. The group’s claim describes a ransomware attack in which internal files were exfiltrated. No further verified details have been released about the method of intrusion, the exact timing of the attack, the volume of data taken, or whether systems were encrypted in addition to the claimed theft. The number of people affected is listed as unknown. No official confirmation or detailed incident report from the organisation itself appears in the available record, so the worldleaks listing remains an unverified claim at this stage.

Who is worldleaks?

Worldleaks is a ransomware group that operates in the familiar double-extortion model used by many modern ransomware actors. Groups of this type typically gain access to a network, move laterally to locate valuable data, exfiltrate copies of files, and then encrypt systems or threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. Worldleaks maintains such a site where it lists victims and, in some cases, posts samples or larger archives of claimed data. Like other ransomware operations, it has been observed targeting organisations across multiple sectors and geographies. Specific claims made by the group about any individual victim, including Nuclebrás Equipamentos Pesados, should be treated as assertions rather than established fact unless independently verified.

About Nuclebrás Equipamentos Pesados

Nuclebrás Equipamentos Pesados S.A., commonly known as NUCLEP, is a Brazilian state-owned company under the Ministry of Science, Technology, Innovation, and Communications. Founded in 1975, it develops and manufactures heavy equipment, with a particular focus on components for nuclear power plants. It also supplies solutions for offshore oil platforms and submarine construction, placing it at the intersection of Brazil’s nuclear, energy, and defence-related industrial base. Organisations of this type routinely handle technical designs, supplier contracts, employee records, project documentation, and communications that support critical national infrastructure. A breach involving such an entity therefore carries potential consequences not only for individuals whose personal data may be present, but also for industrial security and supply-chain partners.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory of data types—such as specific categories of personal information, financial records, or technical documents—has been publicly disclosed. Organisations in the heavy-equipment and nuclear-supply sector typically maintain employee and contractor personal data, payroll and human-resources files, engineering drawings, quality-assurance records, supplier contracts, and operational correspondence. Whether any of those categories were among the files claimed by worldleaks remains unconfirmed. Readers should treat the exact contents as unknown until further official information appears.

What's at stake

For individuals, the primary risks are identity-related fraud, targeted phishing, and social-engineering attempts that leverage any personal or professional details that may have been present in internal files. Even limited contact information or employment records can be combined with other publicly available data to craft convincing scams. For the organisation, the stakes include potential disruption to operations, exposure of sensitive industrial information, regulatory scrutiny under Brazilian data-protection rules, and reputational effects with partners in the nuclear, oil, and defence sectors. Because the scale and precise contents remain undisclosed, the full extent of these risks cannot yet be measured.

If your data was in this claimed breach

If you have a past or present connection to Nuclebrás Equipamentos Pesados—as an employee, contractor, supplier contact, or other stakeholder—consider the following practical steps:

• Monitor financial and email accounts for unexpected activity or phishing messages that reference the company or your role.
• Enable multi-factor authentication on important accounts and change passwords that may have been reused across work and personal systems.
• Be cautious of unsolicited calls or messages claiming to relate to the incident; verify any such contact through official channels.
• Review credit or identity-monitoring options available in your jurisdiction if you believe sensitive personal data may have been involved.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets.

Public detail on this incident remains limited. Continue to watch for any official statements from the company or Brazilian authorities, and treat claims from the ransomware group with appropriate caution until independently verified.

AICompiled with AI assistance from public sources and published under our editorial standards.