Nova ransomware group lists Novabio (france laboratories) on its leak site

• Ransomware group: Nova
• Country: France
• Sector: Healthcare
• Announcement date: December 10, 2025

Nova ransomware group claims data breach at Novabio

On December 10, 2025, an announcement was posted on a leak site claiming that the data of Novabio, a French laboratory, has been leaked. The threat actor, identified as the Nova ransomware group, claims to have exfiltrated a significant amount of information from the organization's systems.

According to the claims made by the threat actor, the organization's network has been encrypted and data has been exfiltrated. The actor states that they are prepared to provide a decryptor and delete the stolen data in exchange for a ransom, though a specific ransom demand was not mentioned in the announcement. The post further mentions that samples of the stolen data may be provided to demonstrate the validity of the breach.

Details of the alleged data exfiltration

The group claims to have stolen 500GB of data, consisting of millions of files. The leaked data is said to include information related to kalilab and france laboratories, as well as various other sensitive categories. The specific types of data and files mentioned in the claim include:

• Patient information
• Doctor information
• Financial data
• Screening results
• SSH keys
• PDF files
• DOC files
• XLSx files
• SQL data

The exposure of such diverse file types, ranging from database files to administrative documents and authentication keys, represents a significant potential security risk for the targeted entity.

About Novabio

Novabio is a medical biology laboratory operating in southwestern France, particularly in the Dordogne and Gironde regions. The institution provides various medical testing and analysis services for patients and doctors.

Potential impact and security implications

The alleged leak may affect the organization's operations and patient safety. The nature of the leaked data could lead to high-level data breach consequences under GDPR (EU) regulations. The exposure of personal health information may increase the risk of targeted phishing or identity theft. Furthermore, the potential leak of SSH keys could create secondary risks to network security, potentially allowing for further unauthorized access.

This situation may result in reputational damage and legal sanctions for the institution. It is worth noting that public information regarding the Nova group is limited. In such scenarios, organizations often face the challenges of double extortion, a tactic where attackers not only encrypt systems to disrupt operations but also steal sensitive data to threaten public disclosure if a ransom is not paid.

To defend against such threats, organizations in the healthcare sector typically focus on robust security measures. This includes implementing strong access controls, maintaining regular backups, and monitoring networks for unusual activity. Protecting sensitive credentials, such as SSH keys, and ensuring compliance with data protection regulations like GDPR are also critical components of a modern cybersecurity posture. The presence of highly sensitive medical and personal information makes healthcare providers a frequent target for ransomware groups seeking to maximize their leverage through the threat of data exposure.