strtn.org listed by Nova ransomware group on leak site

• Ransomware group: Nova
• Country: United States
• Sector: Healthcare
• Announcement date: December 15, 2025

Nova ransomware group claims data breach at strtn.org

The ransomware group known as Nova has officially listed the organization strtn.org on its dedicated leak site. According to the announcement published on December 15, 2025, the threat actors claim to have successfully targeted the institution and are currently facilitating a process related to the publication of the alleged stolen information.

This development follows a pattern common among modern ransomware operations, where groups use public-facing leak sites to pressure victims. By listing an organization, these groups aim to create visibility for the breach, often as part of a broader extortion strategy designed to force the victim into compliance through the threat of public exposure.

Details of the alleged attack

The announcement made by the Nova group alleges that a data breach has occurred at strtn.org. The group claims to have obtained the institution's data, though they have not provided specific details regarding the exact nature of the incident or the timeline of the initial access. The claim was made on December 15, 2025, the same day the announcement appeared on the group's platform.

While the group has asserted that they have successfully exfiltrated information, the announcement remains vague regarding the specifics of the operation. The group is currently managing the process of information disclosure, which is a standard step in many ransomware campaigns aimed at maximizing leverage over the target organization.

Scope of the leaked information

Regarding the specific content of the data allegedly stolen by the Nova group, there is currently no information available. The listing does not provide any explanation regarding the type or the scope of the data that has been compromised. Furthermore, the group has not disclosed any specific details regarding the volume of files or the total size of the data set involved in this incident.

Summary of data details

• No specific data types or file counts have been identified in the announcement.

The lack of detail in the initial leak site posting is common in the early stages of a ransomware extortion attempt, as groups often withhold specific information to increase the pressure on the victim to meet their demands.

About the Tunisian Society of Radiology

The organization targeted, strtn.org, is identified as the Tunisian Society of Radiology (STR). This is a professional medical association that was founded in 1952 in Tunisia. The organization operates within the field of radiology and serves as a professional hub that brings together radiology professionals to support scientific research and professional development within the medical community.

Implications and defensive considerations

This incident suggests that the institution's digital assets and sensitive data may have been exposed to unauthorized access. Because the organization operates within the healthcare sector, a potential data breach of this nature could lead to significant legal and administrative sanctions under various regulatory frameworks, such as HIPAA, which governs the protection of sensitive patient health information.

Beyond the immediate institutional impact, the breach poses secondary risks to the individuals associated with the organization. Employees and members of the institution may face various threats, including identity theft or highly targeted phishing attacks, as their personal or professional information is potentially compromised.

Risk assessment and mitigation

The tactics employed by the Nova group suggest the potential use of double-extortion methods. In a double-extortion scenario, attackers not only encrypt the victim's systems but also steal sensitive data, threatening to leak it publicly if a ransom is not paid. This increases the pressure on organizations to respond to the threat of reputational damage and regulatory penalties.

For organizations operating in the healthcare and professional association sectors, several defensive and reactive steps are critical:

• Forensic Investigation: Conducting a comprehensive forensic investigation is essential to determine the entry point, the extent of the lateral movement, and the exact scope of the data exfiltration.
• Notification Protocols: It is vital for the institution to identify and notify all affected parties, including members and employees, to mitigate secondary risks like phishing.
• Regulatory Compliance: Organizations must evaluate their legal obligations regarding data breach notifications to ensure compliance with regional and sector-specific regulations.
• Enhanced Monitoring: Implementing robust monitoring and detection capabilities can help identify unauthorized access attempts before data exfiltration occurs.