National Institute of Materials Physics Listed by Nova Ransomware Group

On November 23, 2025, the National Institute of Materials Physics in Bucharest, Romania, appeared on the leak site of the nova ransomware group. The institute, which conducts research in solid state physics and materials science, had internal files exfiltrated during a ransomware attack. While the exact number of people whose information may have been exposed remains unknown, any staff, contractors, research partners, or students whose personal or professional details were stored in those systems could now be at risk.

Reported Details of the Breach

Public reporting indicates the National Institute of Materials Physics was listed on the nova ransomware group’s leak site on November 23, 2025. The group claims to have exfiltrated internal files before encrypting systems. No specific volume of records or exact data types has been publicly detailed, but typical ransomware incidents of this nature often include employee records, correspondence, research data, and documents containing names, email addresses, phone numbers, and other personally identifiable information. The institute has not yet issued a public statement confirming the attack or the scope of the data loss.

Why This Matters for You and Your Family

When a research institute suffers a breach, the information exposed rarely stays inside the organization. Names, email addresses, phone numbers, and project details can be sold or published, giving criminals an entry point into your life. If you or a family member work at or collaborate with the National Institute of Materials Physics, your data may already be circulating. Even indirect connections — such as being listed as an emergency contact, research co-author, or vendor — can place you in the exposed dataset. Once criminals have one piece of accurate information, they can combine it with data from other breaches to build a profile that leads to identity theft, phishing campaigns, or harassment directed at you or your children.

The Doxxing and Identity-Chain Risks

Leaked institutional files frequently contain not just names and emails but also links between professional identities and personal ones. A work email might connect to a personal phone number, which in turn links to a home address or a child’s school record. Criminals exploit these chains to move from one account to another. Credential leaks like this one often cascade into gaming account takeovers, especially for children who reuse passwords or security questions tied to a parent’s professional life. Once a gaming account is compromised, attackers can harvest additional personal details, photos, and chat logs that further expand the doxxing chain. The result is a growing web of information that can be used for extortion, swatting, or long-term identity fraud.