ShapeCorp Listed by Nova Ransomware Group
If you are a customer of ShapeCorp, here’s what is being claimed, and what it would mean for you.
ShapeCorp was listed on Nova's leak site. Nova claims to have stolen internal data. This is the group's claim, not a confirmed finding.
On October 11, 2025, automotive supplier Shape Corp. appeared on the leak site of the nova ransomware group after the company’s internal files were allegedly exfiltrated during a ransomware attack.
Watch ShapeCorp
Get alerted the next time ShapeCorp files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about ShapeCorp’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details of the Incident
Public reporting indicates that nova actors gained access to Shape Corp.’s network, encrypted systems, and then published a sample of stolen data as proof of compromise. The exposed material includes engineering design files, CAD drawings, mechanical designs, CNC programs, project documentation, automation data, marketing assets, brand media, financial records, and production information. No confirmed victim count for individuals has been released, and the precise number of employees or customers whose personal information may be contained in the files remains unknown. The leak site listing carries the date October 11, 2025, and follows the group’s standard pattern of posting compressed archives after giving the victim a short negotiation window.
- Every indexed leak tied to your address — all of them, named and dated
- A deeper search of collected breach data — the kinds of your information it holds, where it finds you
- What this kind of incident typically exposes
- A ten-minute lock list written for this kind of organisation
Why This Matters for You and Your Family
When a manufacturer like Shape Corp. loses control of internal files, the consequences often reach far beyond the company. Engineering documents and project files frequently contain names, email addresses, phone numbers, physical addresses, and occasionally Social Security numbers of employees, vendors, and partners. If any of that information belongs to you or someone in your household, it can be combined with data from previous breaches to build a complete profile. Criminals then use these profiles for identity theft, loan fraud, or targeted phishing campaigns that feel personal because they reference real details from your life or your children’s activities.
The Doxxing and Identity-Chain Risks
Stolen corporate files rarely stay isolated. A single leaked email or username can be cross-referenced across dozens of other breaches, gaming platforms, social media accounts, and data-broker records. This creates an identity chain that links your work identity to personal handles, family member names, and even children’s gaming accounts. Once the chain exists, attackers can move from simple credential theft to full doxxing—publishing home addresses, phone numbers, and photos—within hours. Credential leaks of this type have repeatedly led to account takeovers on Steam, Roblox, Discord, and other platforms where children maintain profiles tied to the same email addresses used at work or school.
What to Do
- Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see the exposure created by this and earlier breaches.
- Rotate any password you used at Shape Corp. or related vendor systems and enable two-factor authentication through an authenticator app on every account where that password was reused.
- Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak that touches your family is flagged within hours rather than months.
- Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails exposed in corporate incidents.
- Let remediation specialists handle takedown requests for any personal records that surface on data-broker or doxxing sites connected to this leak.
The nova group’s appearance on the Shape Corp. listing is a reminder that ransomware operators continue to target manufacturers that hold valuable intellectual property and personal data in the same systems. While you cannot prevent every breach, you can limit how far the exposed information travels. Start by understanding exactly which pieces of your identity are already circulating, then close the gaps before criminals stitch them into a usable profile. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—turning a reactive breach notice into a manageable remediation plan.
What the free scan actually returns
Found on people-search siteswe remove these
These listings are live, public, and legal to remove — and removing them is what we do.
Found in breach recordsverifiedreported — unverified
Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.
Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.
