SWISS ROSE Factory Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 15, 2025, the nova ransomware group listed SWISS ROSE Factory on its leak site and claimed to have exfiltrated internal files from the company. No confirmed count of affected individuals has been released, and the precise scope or contents of the material remain undisclosed beyond the group's assertion of a ransomware operation. The incident fits a pattern in which ransomware actors continue to publish victim names after encryption and data removal, regardless of whether ransom demands are met. Public reporting on the event is limited to the leak-site entry itself.

Breaking down the breach

The only confirmed detail is the November 15, 2025 listing by nova. The group states that internal files were taken during a ransomware attack. No information has been made public about the date of the intrusion, the volume of data, the encryption status of systems, or any ransom negotiation. The number of people potentially affected is listed as unknown.

Inside nova

Nova operates as a ransomware group that employs double-extortion methods: systems are encrypted while selected files are removed and later used as leverage on a dedicated leak site. The group has previously claimed responsibility for intrusions across multiple sectors and geographies. Its listings function as public assertions rather than independently verified incidents; confirmation of any specific claim requires separate evidence from the named organization or law-enforcement sources.

About SWISS ROSE Factory

SWISS ROSE Factory is an Iraqi company established in 2019 that markets cleaning and personal-care products under the O2 brand. Its product lines cover home care, fabric care, surface care, and personal care items distributed to consumers and commercial clients. Organizations of this type routinely maintain records related to manufacturing, supply chains, customer accounts, and regulatory compliance.

The information in question

The only data category named in connection with the incident is “internal files exfiltrated in ransomware attack.” No further breakdown—such as customer records, financial documents, or employee information—has been released. Exact contents therefore remain unconfirmed.

The real-world impact

Exposure of internal operational files can create secondary risks for a manufacturing and distribution company, including competitive intelligence concerns or follow-on targeting of business partners. For individuals whose details may appear in such files, the primary issues are potential misuse of contact information or account credentials if those appear in the material. The absence of a confirmed data inventory makes it impossible to quantify these risks at present.

Were you affected?

Individuals concerned about possible exposure should monitor official statements from SWISS ROSE Factory and review any direct notifications the company may issue. A practical first step is to run a free exposure scan of your email address against known breach data sets and to change passwords for any accounts that reuse credentials found in past incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.