SWISS ROSE Factory Listed by Nova Ransomware Group

On November 15, 2025, the nova Ransomware Group listed Swiss Rose Factory on its leak site, claiming that internal files had been exfiltrated from the Iraqi manufacturer of O2-brand home care, fabric care, surface care, and personal care products.

What Public Reporting Shows

Public reporting indicates the company, established in 2019 and active in the Iraqi consumer goods market, appeared on the nova leak site hosted at an onion address. The listing states that data was stolen during a ransomware incident, though the exact volume and full list of exposed records remain undisclosed. Available details describe the exposed material as internal files rather than a structured database of customer records. No confirmed count of affected individuals has been published, and the company has not issued a public statement detailing the breach scope as of the latest available information.

Why This Matters for You and Your Family

When a manufacturer like Swiss Rose suffers a breach, the stolen internal files can contain supplier lists, employee records, customer orders, or distributor contacts that include names, addresses, phone numbers, and email accounts. If your family has ever purchased O2 cleaning or personal care products through local retailers, an online order, or a wholesaler, your information may now sit in an attacker-controlled archive. Once exfiltrated data leaves the company’s control, it can be sold, traded, or used to launch follow-on attacks against you personally. Ordinary families are the end targets because household details harvested from corporate systems provide the raw material for identity theft, phishing, and harassment that feels intimate and hard to trace.

The Doxxing and Identity-Chain Implications

Leaked internal files frequently link corporate email addresses to personal accounts, phone numbers, and home addresses. Attackers then chain these fragments across dozens of other breaches to build a complete profile. A single exposed order record can reveal your name, delivery address, and phone number; that combination is then cross-referenced with credential leaks from shopping sites, loyalty programs, or even your children’s gaming accounts. The result is a doxxing chain that can expose your family’s daily routines, financial habits, and online handles within hours of the data appearing on underground forums. Credential leaks like this one routinely cascade into account takeovers precisely because the same password or recovery email is reused across work, shopping, and gaming services.

Nova Ransomware Group’s Known Track Record

Public reporting attributes the attack to the nova Ransomware Group, which emerged in early 2024. The group has claimed responsibility for incidents against manufacturing, logistics, and retail companies across multiple regions. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of internal documents before encryption. Nova then demands payment and, upon non-payment, publishes samples or full datasets on its leak site to pressure victims. The group’s extortion style relies on public embarrassment and the implicit threat that stolen files will be sold to other criminals if the ransom is not met.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing your family is caught in hours rather than months.
• Rotate any password you used on sites connected to Swiss Rose or its distributors, and switch on 2FA through an authenticator app instead of text messages.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same home address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate with threat actors yourself.

The incident shows that even manufacturers of everyday household products can become gateways to personal exposure. A forward-looking approach means treating every breach as a link in a larger chain and acting before criminals complete the picture. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to the same credential cascades seen in attacks like the one against Swiss Rose Factory.