Rconcept Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Rconcept has been listed by the nova ransomware group, with internal files reported exfiltrated in an attack disclosed on December 19, 2025. An undisclosed number of individuals may have been affected; check Rconcept’s notices and monitor your accounts for any signs of compromise.
Breaking down the breach
The incident was reported through the listing of Rconcept on the nova group’s leak site. The only confirmed detail is that internal files were removed from the organisation’s systems. No information has been released on the date of the intrusion, the method of initial access, the duration of unauthorised activity, or whether encryption was also deployed. The number of records or files involved has not been stated.
The group behind it: nova
Nova is a ransomware operation that has been publicly tracked for several years. The group typically uses double-extortion tactics, first encrypting systems and then removing copies of data before demanding payment. Its listings on dedicated leak sites serve as a pressure mechanism when victims decline to pay. The appearance of Rconcept on the site constitutes the group’s claim that it holds material from the company; independent confirmation of the data’s contents or authenticity has not been provided in public reporting.
Who is Rconcept?
Rconcept is a Belgian firm engaged in the research, design and manufacture of mechanical and electrical components. Organisations of this type routinely maintain engineering specifications, supplier and customer records, production data and internal communications. A compromise at such a company can affect both proprietary technical information and the personal or commercial data of its business partners.
What was likely exposed
The only data category named in connection with the incident is internal files. The exact categories of information contained in those files have not been disclosed. Companies in the mechanical and electrical manufacturing sector commonly store design documents, test results, client specifications and employee records, but it is not possible to confirm whether any of these specific types were taken in this case.
The real-world impact
Exposure of internal engineering files could create competitive or supply-chain risks for Rconcept and its clients. If personal data of employees or customers is present among the files, those individuals may face increased chances of targeted phishing or identity misuse. The organisation itself may incur costs related to investigation, remediation and any regulatory notifications required under Belgian or European data-protection rules.
Were you affected?
Individuals who have had business dealings with Rconcept or who work in its supply chain can take the following steps while waiting for official notifications:
- Monitor official communications from the company for guidance on any confirmed data categories.
- Run a free exposure scan of their email address against known breach repositories to check for prior appearances of their information.
- Enable multi-factor authentication on accounts that may share credentials with any services linked to the company.
- Review bank and credit statements for unusual activity in the coming months.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
grupopuma Listed by nova Ransomware GroupCaros co Listed by nova Ransomware GroupANG BROTHERS (M&E) PTE. LTD. (P2) Listed by nova Ransomware GroupMedidores Industriales y Medicos SA de CV Listed by nova Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Rconcept Listed by nova Ransomware Group →
Publicly posted by nova — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.