Saude Fortaleza listed on nova ransomware leak site

• Ransomware group: nova
• Country: Brazil
• Sector: Healthcare
• Announcement date: November 15, 2025

Nova group claims intrusion into Saude Fortaleza

The threat actor known as nova has announced the listing of data belonging to Saude Fortaleza on its leak site. This announcement, made on November 15, 2025, marks a new addition to the group's public list of targets. According to the post, the group claims to have successfully executed an intrusion into the digital infrastructure of the organization.

The group known as nova has officially added Saude Fortaleza to its leak site. The post accompanying the announcement claims that an intrusion has occurred within the organization's digital infrastructure. At this time, information regarding this specific threat group remains limited in the public domain, making it difficult to establish a comprehensive profile of their typical tactics or motivations.

Details of the alleged data exfiltration

Regarding the specifics of the claimed breach, the post on the leak site does not specify the nature of the data allegedly exfiltrated. While the group has claimed an intrusion, they have not provided details regarding the specific categories of information that were targeted or stolen during the event.

• No specific data types were named in the listing.

About Saude Fortaleza

The Municipal Health Secretariat of Fortaleza is a government agency responsible for the management and coordination of public health services in the city of Fortaleza, Brazil. As a central entity in the regional healthcare administration, it plays a critical role in the delivery and oversight of medical services for the local population.

Potential risks and industry implications

Given that the institution operates in the healthcare sector, the verification of these claims could pose a risk of exposing sensitive patient data. Such an incident may lead to legal sanctions and administrative fines under Brazil's LGPD regulations. The potential exposure of medical information carries significant weight due to the sensitive nature of healthcare records.

Furthermore, there may be a risk of identity theft or targeted phishing attacks against employees and service recipients. When threat actors gain access to organizational networks, they often seek to exploit the personal information of both staff and clients to conduct secondary attacks. The threat actor's intent to publish data could result in reputational damage and disruption to the organization's operational processes.

It is important to note that groups utilizing double extortion tactics typically demand ransom to prevent the publication of exfiltrated data. In these scenarios, attackers do not just encrypt systems to halt operations, but also steal sensitive information to use as leverage during negotiations. Organizations facing such threats often focus on robust data protection, continuous monitoring, and incident response planning to mitigate the impact of potential leaks.