# Textile Testing Services of America breached by Nova ransomware

Published: 2026-05-26 · Severity: routine · Sectors: education
Canonical: https://vorant.io/reports/06f05dd2-c520-532a-b502-245a5218d3d9/textile-testing-services-of-america-breached-by-nova-ransomware

> Nova ransomware operators claim breach of Textile Testing Services of America, exfiltrating data from Mexico-based company.

Nova ransomware operators have claimed responsibility for a breach of Textile Testing Services of America, a training-industry company based in Mexico City with 250-499 employees and $10-25M in revenue. According to the posting on ransomware.live, initial access was gained via the domain sandox.info (IP 64.76.20.226), with the full dataset related to the victim's primary domain ttsamexico.com. The operators claim to have exfiltrated data and are using the standard extortion playbook: posting victim details publicly to pressure payment and threatening further disclosure. The victim company operates in the training sector and may hold employee or client records subject to Mexican data protection regulations.

Defenders in similar organizations should treat this as confirmation that Nova remains actively targeting companies in the region and is willing to publicly shame victims to compel ransom payments. The initial access vector through sandox.info suggests either compromised DNS or a malicious subdomain; defenders should audit their own DNS records, SSL certificates, and external domain registrations for unauthorized entries and monitor for similar reconnaissance patterns.

## Mentioned in this report

- Threat actors: nova
- Malware: Nova

2 detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/VGV4dGlsZSBUZXN0aW5nIFNlcnZpY2VzIG9mIEFtZXJpY2FAbm92YQ==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/06f05dd2-c520-532a-b502-245a5218d3d9/textile-testing-services-of-america-breached-by-nova-ransomware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup