URG OEM Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 17, 2026, the ransomware group nova listed URG OEM on its leak site, claiming to have exfiltrated internal files from the South Korean skincare company. Public information about the incident remains limited to that listing and the general description of files taken during a ransomware operation. No confirmed count of affected individuals or detailed inventory of the material has been released.

The listing matters because URG OEM operates in a sector that routinely processes customer contact details, purchase histories, and formulation records. Even without confirmed numbers, any confirmed exfiltration of internal material from such a firm raises questions about downstream exposure for clients and partners.

Inside the incident

The only confirmed public detail is the May 17, 2026 listing by nova. The group states that internal files were taken during a ransomware attack on urg.co.kr. No official statement from URG OEM has been referenced in available reporting, and the company has not disclosed the volume of data, the encryption status of systems, or whether any material was later published. The number of people potentially affected is listed as unknown.

Inside nova

Nova is a ransomware operation that maintains a public leak site where it lists organizations it claims to have targeted. The group follows the common pattern of encrypting systems and copying data, then using the threat of publication to pressure victims. Its listings have covered companies across multiple countries and industries in recent years. In this case the group claims URG OEM as a victim; that claim has not been independently verified beyond the site posting itself.

About URG OEM

URG OEM is the operating name associated with urg.co.kr, a South Korean company founded in 1990. It began with the Shangpree Spa line and expanded into multiple skincare brands sold domestically and internationally. The firm positions itself as a premium supplier of spa and cosmetic products, which means it maintains records related to product development, customer transactions, and distribution partners. Breaches at manufacturers in this sector can expose both proprietary formulation data and personal information collected from retail or professional clients.

The information in question

The listing describes “internal files exfiltrated in ransomware attack.” No further breakdown of file categories, record counts, or time periods has been published. Companies of this type commonly hold customer names, addresses, purchase histories, and internal correspondence; however, the precise contents of the material claimed by nova remain unconfirmed.

What's at stake

Exfiltrated internal files can contain customer contact information that later appears in phishing campaigns or resale markets. For the organization, disclosure of formulation or supplier details may affect competitive position and contractual obligations. Because the scale of the data remains undisclosed, the concrete impact on any single individual cannot yet be quantified from public sources.

If your data was in this claimed breach

Monitor accounts associated with the email address or phone number you used when purchasing from URG OEM brands and enable multi-factor authentication where available. Request data deletion or account closure directly from the company if you no longer need the relationship. A free exposure scan of your email address against known breach repositories can show whether your information has already appeared in other public data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.