University of Gävle listed on nova ransomware leak site

• Ransomware group: nova
• Country: Sweden
• Sector: Education
• Announcement date: November 15, 2025

The University of Gävle, a public institution based in Sweden, has been listed on a ransomware leak site by a threat actor known as nova. The group has made claims against the institution, alleging that they have successfully gained access to the university's data. This development marks a potential cybersecurity incident for the Swedish educational institution.

The claimed attack and group profile

On November 15, 2025, the threat actor group identified as nova officially listed the University of Gävle on its leak site. In the announcement, the group made claims against the institution, asserting that they have obtained access to the university's internal data. This type of activity is characteristic of modern ransomware operations, where threat actors often use leak sites to pressure victims by threatening to release sensitive information.

Regarding the threat actor known as nova, public information remains limited. There is a lack of extensive documentation in the public domain concerning the specific methods, origins, or long-term objectives of this group. This limited visibility is common with emerging or niche ransomware groups that operate with a degree of anonymity to evade detection and law enforcement intervention.

Data involved in the claim

While the group has claimed to have accessed the institution's data, no specific details regarding the nature of the allegedly leaked data have been provided. The listing does not specify the types of files, the volume of information, or the specific databases that were targeted during the alleged intrusion.

The organization profile

The University of Gävle is a public university located in Gävle, Sweden. Established in 1977, the institution serves as a significant educational hub in the region. The university offers a diverse range of academic programs, including bachelor's and master's degrees across several disciplines. Its academic focus covers technology, social sciences, natural sciences, and the humanities.

Risk assessment and implications

The claims made by nova could bring a significant risk of exposure for the institution's academic and administrative data. If the allegations are accurate, the potential leakage of student and staff information could create a foundation for various secondary cyber threats. Specifically, such data can be utilized to facilitate identity theft or to launch highly targeted phishing attacks against members of the university community.

Furthermore, as an institution operating within Sweden, a potential data breach may lead to significant legal consequences under the EU General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict protocols regarding the protection of personal data, and failures in data security can result in regulatory scrutiny and legal liabilities.

Considering the methods typically employed by groups like nova, the institution may face both operational disruptions and substantial reputational damage. Ransomware attacks often aim to paralyze organizational functions, making it difficult for educational institutions to maintain their standard academic and administrative services. To mitigate such risks, organizations in the education sector often focus on robust defensive measures, such as implementing multi-factor authentication, maintaining rigorous backup protocols, and conducting regular security awareness training for staff and students.