University of Valencia Confirms Server Access, Disputes NOVA’s Broader Data Claims
Summary
The University of Valencia says attackers accessed an obsolete research server and exposed limited personal material, but disputes NOVA’s claim of 300 GB of sensitive data, including student and staff records.
Key points
- The ransomware group NOVA claimed it compromised the university’s systems and exfiltrated 300 GB of data, threatening to publish it unless the university met its demands.
- A university spokesperson said attackers accessed an obsolete server belonging to a research group.
- The university said the server held old surgical training videos and personal photographs belonging to the researcher who led the group.
- The university disputed NOVA’s claims about student and staff records, saying no student or staff accounts were affected.
- The university said it had backups, secured the affected space, would not pay a ransom, and planned to report the incident to police.
Article Details
- Victim Organization
- Universitat de València
- Incident Type
- Cyberattack involving access to an obsolete research-group server; NOVA claimed ransomware-related data theft and threatened publication, but encryption is not confirmed in the article.
- Data Types Exposed
- Personal photographs of the researcher who led the group
- The university said the server also held old educational videos of surgical operations in which individuals could not be identified
- NOVA claimed to have obtained staff and student information and images, including images that could depict minors; the university denied that student or staff data were affected
- Affected Records
- Not disclosed; the university said the only compromised personal data belonged to one researcher.
- Affected Data Size
- NOVA claimed to possess 300 GB. The university said the 300 GB figure was plausible given the size of the audiovisual material, but did not confirm that 300 GB of data had been exfiltrated.
- Operational Impact
- The university said the attackers accessed an obsolete server on a Saturday afternoon and that staff worked to resolve the incident. It said backups were available and the affected space had been secured. No wider service disruption was reported.
- Ransom Or Extortion
- NOVA reportedly gave the university one week to meet its undisclosed financial demands or the group would publish the data. The university said it would not pay. The article does not confirm that the ransom demand was paid.
- Claim Status
- confirmed
Threat Actors
NovaThe article identifies NOVA as a ransomware-as-a-service group and reports that it claimed responsibility for compromising the university's systems, exfiltrating 300 GB of data, and threatening publication unless its financial demands were met. The university confirmed access to an obsolete research server but disputed the claims that student and staff data were affected.RALordThe article describes NOVA as having emerged following an evolution of RALord; it provides no further specific activity attributed to RALord.