Universite de Pau et du Pays de lAdour Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target universities and research institutions, treating them as high-value sources of personal records, administrative files and operational data. In this environment, listings on criminal leak sites have become a common way for attackers to pressure victims and advertise their activity. One such listing, dated 29 September 2025, concerns the Université de Pau et du Pays de l'Adour and is attributed to the group known as nova.

Public detail remains limited to the claim published by the group itself. No independent confirmation of the intrusion, the volume of data taken or the precise contents has been released by the university. The incident nevertheless matters because higher-education establishments hold large volumes of personal and institutional information whose exposure can create lasting risks for students, staff and the organisation.

What happened

On 29 September 2025 the Université de Pau et du Pays de l'Adour was listed by the nova ransomware group. The listing asserts that the group carried out a ransomware attack and exfiltrated internal files. The group further claims to have stolen 80 GB of data and offers a decryptor, a report, and the return and deletion of the data if its demands are met. The number of people affected is unknown, and no technical details of the intrusion method or timeline have been disclosed in the available record. The listing itself constitutes an unverified claim by the threat actor.

Who is nova?

Nova is a ransomware operation that has appeared on public leak sites in recent years. Like many such groups, it typically encrypts systems, exfiltrates data and then posts victim names to pressure payment. Public reporting on nova describes a pattern of double-extortion tactics: data theft followed by threats to publish or sell the material if a ransom is not paid. The group has been associated with attacks on organisations across multiple sectors, though the precise scale and longevity of its activity remain subjects of ongoing open-source tracking. In this case the only specific claim about the Université de Pau et du Pays de l'Adour is the leak-site listing itself; no additional statements by nova beyond that listing are recorded in the facts.

Who is Université de Pau et du Pays de l'Adour?

The Université de Pau et du Pays de l'Adour is a French public university founded in 1972. It operates as a multi-site establishment with campuses in Pau, Bayonne, Tarbes and Mont-de-Marsan and belongs to the Academy of Bordeaux. As a higher-education and research institution it routinely processes student enrolment records, staff employment files, academic documents, financial and billing information, research materials and internal administrative data. A breach at such an organisation is consequential because the data it holds often includes identifiers, contact details and other personal information that can be reused for fraud, identity misuse or further targeted attacks, while disruption of systems can affect teaching, research and administrative continuity.

What was likely exposed

The available facts state that internal files were exfiltrated in a ransomware attack. The group claims the stolen material comprises 80 GB of data that includes documents, reports, billing PDFs, plans, factory and payments documents, full worker information, complete student and teacher data including private IDs, resources and additional unspecified files. These descriptions originate solely from the threat actor’s listing and have not been independently verified. Organisations of this type typically hold student and staff personal records, academic and research files, financial and contractual documents, and internal operational materials. Exact contents and the true volume of any exfiltration remain unconfirmed.

Why it matters

If the claimed data were indeed taken, individuals whose records appear in student, teacher or staff files could face risks of identity theft, phishing, or unsolicited contact. Billing and payment documents may contain financial details that could be misused. For the university, the incident raises operational, reputational and regulatory concerns common to any large public institution that processes personal data. Because the number of people affected is unknown and the precise data set is unconfirmed, the full scope of harm cannot yet be measured; the primary immediate risk is the potential circulation of personal and institutional information beyond the organisation’s control.

What to do if you're exposed

Anyone who has studied or worked at the Université de Pau et du Pays de l'Adour, or who has had financial or administrative dealings with it, should treat the possibility of exposure seriously until more information is available. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and other important accounts, and be alert to phishing messages that reference the university or personal details. Consider placing fraud alerts with relevant credit-monitoring services if you are in a jurisdiction that offers them. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official guidance from the university or French data-protection authorities should be followed as soon as it is issued.

AICompiled with AI assistance from public sources and published under our editorial standards.