Ransomware Gang Nova Poised to Leak Patient Data, Lab Stays Mum on Negotiations
With ransomware gang Nova threatening to leak patient data on the darkweb, a Dutch laboratory that performs cervical cancer tests for a government screening program is mum about the ransom negotiations, but it says the cyberattack in July has affected 941,000 patients – nearly double the initial estimate of 485,000 people.
See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense
Bevolkingsonderzoek Nederland, or BVO NL, a research agency which oversees the national Population Screening Netherlands programs for screening three types of cancer – breast, colon and cervical – in a statement Friday said that Clinical Diagnostics NMDL, the lab that handles the program’s cervical cancer screenings, has informed the agency that another 230,000 patients have had their information “leaked” in the lab’s recent hack (see: Data Theft from Dutch Cancer Screening Lab Affects 485,000).
Ransomware-as-a-service gang Nova had first threatened in July on its dark website to leak the lab’s stolen data. Nova is a relative newcomer that some security researchers say distributes the RALord ransomware to encrypt files, exfiltrate sensitive data and use double extortion tactics to pressure victims.
Since then, in posts on the gang’s dark site on Aug. 17 and Aug. 22, Nova appeared to be bickering with Clinical Diagnostics and its parent company, Eurofins Scientific, over negotiations pertaining to payment “deals” to prevent further leakage beyond samples of the lab’s stolen data.
Clinical Diagnostics in an Aug. 18 post on its website about the incident acknowledged threats by the attacker, but didn’t name the gang.
“Previously, we indicated that we have no indications that the attacker will proceed to leak the copied data. We are aware of the fact that the attacker is once again threatening to leak copied data. This new development obviously has our attention. As indicated earlier, we cannot provide further information regarding certain details.”
Population Screening Netherlands made the decision to notify all patients “whose data has ever been shared with the laboratory” since 2017 about the hacking incident, adding that “Clinical Diagnostics cannot confirm that this is the full extent of the data breach,” Populations Screening Netherlands said.
“We realize that this is a very unpleasant message for participants in the cervical cancer screening. We are very sorry that this has happened. We are communicating this now because participants have to take into account possible phishing and fraud.”
Population Screening Netherlands said that in addition to Clinical Diagnostics, the agency is working on carrying out cervical cancer screenings with several other laboratories that have not been affected by the hack.
Clinical Diagnostics and Eurofins did not immediately respond to Information Security Media Group’s requests for comment on Nova’s claims, and for other details pertaining to the hacking incident.
Breach Details
Clinical Diagnostics in the notice on its website about the incident said the information potentially compromised in the hack includes name, gender, date of birth, address, details about the type of examination and test results, citizen service number – or BSN, details of the applicant and name of health insurer (see: ISMG Editors: Dutch Lab Hack Shows Healthcare Security Gaps).
“Recognized healthcare providers in the Netherlands are legally obliged to record and store the BSN of their patients. They use the BSN when they exchange data about patients. That is why the BSN was also in the leak at Clinical Diagnostics,” the lab said.
The hackers gained unauthorized access to part of the IT environment of Clinical Diagnostics NMDL and Clinical Diagnostics LCPL, both located in Rijswijk, the lab said. “No other laboratories within the network of Clinical Diagnostics Netherlands have been affected by this incident,” the lab said.
“Despite rapid detection and intervention, we know that access was gained to personal data of patients and referrers that were stored in this part of the IT environment. Certain personal data have also been copied.”
The lab also said that Netherlands’ Public Prosecution Service has launched an investigation into the incident.
Relative Newcomer
Ransomware.live, a blog that monitors cybercriminal gangs and their attacks, counts 37 Nova victims since the group first surfaced in April 2025.
“Nova has emerged as a financially motivated ransomware-as-a-service operation, built around the RaLord ransomware family,” said Jeremy Makowski, a Rapid7 security researcher. “While the group’s TTPs demonstrate a mature RaaS model, its IOCs offer defenders actionable points for detection.”
Nova’s encryptors are written in Rust and leave behind files with extensions such as “.ralord” or “.RNOVA”, alongside ransom notes labeled “README-Nova”, he said.
The group directs victims to contact them through private messengers like Tox or Session, because they prefer to negotiate payment rather than provide traditional fixed-payment instructions, he said. “We can also see from its public victim listings that Nova targets organizations across multiple sectors including healthcare, IT, manufacturing, telecom, education and construction, showing an opportunistic and global focus.”
“Nova is the latest brand in an evolving lineage, so it’s not an entirely new actor. The group operates the RaLord ransomware, which is considered a successor or offshoot of the former RA Group,” Makowski said.
Nova is likely either the parent operator of RaLord or a rebranding initiative continuing its development and affiliate program, he said.
“The group has structured its operations with a classic RaaS incentive system, offering affiliates a percentage of ransom proceeds, mirroring the approach of other criminal organizations.”
So far there is no credible evidence that Nova is linked to a nation-state, Makowski said. “While some of the group’s infrastructure and communications may suggest Russian-speaking characteristics, this is insufficient to conclude that it is state-sponsored. Instead, Nova fits the model of a criminal enterprise focused on profit through extortion.”
Medical Lab Attacks
The cyberattack on a Dutch clinical testing laboratory highlights the significant cyber risks facing medical laboratories worldwide, Makowski said.
“For laboratories, the lessons are clear,” he said. First, they should assume that data theft will occur and plan accordingly through segmented networks, strict access controls, rapid detection of intrusion and data exfiltration attempts, he said.
Second, it’s critical that medical laboratories recognize that they are particularly vulnerable due to their data and regulatory value, making them prime targets for extortion, he said.
“Building resilience against Nova-type attacks requires technical defenses to secure internet-connected systems, monitoring for anomalous data flows, isolation of laboratory instruments and organizational preparation for transparency and recovery.”