Dosab listed on Nova ransomware leak site

• Ransomware group: Nova
• Country: Saudi Arabia
• Sector: Manufacturing
• Announcement date: June 20, 2026

Nova ransomware group claims Dosab breach

The threat actor group known as Nova has officially announced the listing of Dosab on its dedicated leak site. This announcement, made on June 20, 2026, follows a pattern common in modern cyber extortion campaigns where groups target high-value organizations to exert pressure through the threat of data exposure.

In this specific instance, the threat actors have claimed that they have successfully exfiltrated data from the organization. To demonstrate the validity of their claims, the group has stated that they are prepared to provide samples of the allegedly stolen data if the organization chooses to contact their support department. While the listing is a significant development, public information regarding the specific capabilities and history of the Nova group remains limited in the public domain.

Details of the alleged incident

The event was officially announced on the Nova leak platform on June 20, 2026. At this stage, the group has not provided specific details regarding the nature or the volume of the data they claim to have acquired. The announcement serves as a notification of the breach, placing the organization under the pressure of potential public disclosure.

Regarding the specific content of the breach, the current situation is characterized by a lack of granular detail. The listing names no specific data types, and the provided screenshots do not contain any actual data content that would confirm the specific nature of the information involved.

About Dosab

Dosab, formally known as the Demirtaş Organized Industrial Zone, is a significant industrial region located in Bursa. The zone serves as a massive hub for various industrial activities, hosting hundreds of companies across diverse sectors, most notably automotive and textile. Beyond being a collection of businesses, the zone provides essential infrastructure and services to its member companies, including energy supply, wastewater treatment, and various social facilities.

Potential risks and industrial implications

The claim made against Dosab presents several significant risks to the organization's operational continuity and data privacy. If a breach has indeed occurred, the potential impact is vast due to the scale of the organization's operations. Specifically, sensitive information regarding more than 573 companies and 44,000 employees within the region could potentially be exposed.

Given that the organization operates within Turkey, this situation may necessitate a formal evaluation under the Personal Data Protection Law (KVKK). Such a breach could trigger various legal notification obligations to both regulators and the affected individuals. Furthermore, the exposure of such a large volume of data introduces the possibility of secondary attacks, such as identity theft or highly targeted phishing campaigns against the employees and companies within the zone.

Because Dosab provides critical industrial infrastructure services, there is a notable risk that secondary consequences could impact broader supply chain security. In industrial settings, a compromise of a central infrastructure provider can create ripple effects throughout the entire ecosystem of connected companies.

To mitigate such risks, organizations in the manufacturing and industrial infrastructure sectors often focus on several defensive pillars. These include implementing strict network segmentation to prevent lateral movement, maintaining rigorous backup protocols that are isolated from the primary network, and enforcing multi-factor authentication across all access points. Additionally, continuous monitoring and rapid incident response capabilities are essential to minimize the impact of an intrusion and to comply with legal frameworks like KVKK.