Nova
Data as of August 16, 2026.
Credential exposure before the attack
16.3% of Nova victims whose domain we can identify (27 of 166) had employee credentials leak in the 12 months before Nova named them as a victim.
We don't know whether any of these credentials were how Nova gained initial access.
What industries Nova targets
Sector identified for 134 of 166 victims.
| Technology | 25 | |
| Manufacturing | 24 | |
| Education | 18 | |
| Government | 14 | |
| Construction | 10 | |
| Healthcare | 9 | |
| Financial Services | 7 | |
| Logistics | 7 |
Where the victims are located
Country identified for 146 of 166 victims.
| United States | 21 | |
| Brazil | 12 | |
| India | 9 | |
| Italy | 9 | |
| Indonesia | 8 | |
| Spain | 7 | |
| France | 7 | |
| Poland | 6 |
Most recent Nova victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Center of Information Technology in Finance gov.md | Government | Not identified | Jul 27, 2026 |
| Sistnet sistnet.it | Technology | Italy | Jul 27, 2026 |
| Digital Edge digitaledge.net | Energy | Singapore | Jul 24, 2026 |
| VNSO vnso.vn | Technology | Vietnam | Jul 23, 2026 |
| Ahora ahora.com.ar | Media | Argentina | Jul 22, 2026 |
| La Financière d\'Orion lafinancieredorion.fr | Financial Services | France | Jul 22, 2026 |
| Marpatech marpatech.com | Manufacturing | Peru | Jul 22, 2026 |
| JRD Logistics jrd-logistics.com | Logistics | India | Jul 21, 2026 |
| KOPKARLA kopkarla.com | Logistics | Indonesia | Jul 21, 2026 |
| Universidad Nacional de Mar del Plata mdp.edu.ar | Education | Argentina | Jul 21, 2026 |
| Rumah Sakit Universitas Indonesia ui.ac.id | Healthcare | Indonesia | Jul 21, 2026 |
| FMZ Tecnologia em Sistemas fmz.com.br | Technology | Brazil | Jul 20, 2026 |
| Jota Joias Premium jotajoiaspremium.com.br | Retail | Brazil | Jul 20, 2026 |
| Ministry of Transportation of the Republic of Indonesia kemenhub.go.id | Government | Indonesia | Jul 20, 2026 |
| Meral Manisa meralmanisa.com.tr | Manufacturing | Turkey | Jul 20, 2026 |
| DigiPro digipro.com.vn | Technology | Vietnam | Jul 17, 2026 |
| Integrated Marketing Services intmarkserv.com | Not identified | United States | Jul 17, 2026 |
| PHI phi.ca | Not identified | Canada | Jul 17, 2026 |
| Hynet hynet.com.ar | Technology | Argentina | Jul 13, 2026 |
| NSW Rural Fire Service nsw.gov.au | Government | United Kingdom | Jun 29, 2026 |
Showing the 20 most recent of 166. Browse recent data breaches for more.
Nova leak sites
Addresses we've seen Nova publish victims from. Any .onion address needs the Tor Browser.
novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onionmega.nzleak7y2247fj7dbb35rpfyxuyaqtwbshiwxp6h35ttzlhrxmhvi4fead.onionpifk3xu3vad6cuxsjll4qjomyaaaoyvnyqppro75pazadzctrrvpdnyd.onionnovavdivko2zvtrvtllnq45lxhba2rfzp76qigb4nrliklem5au7czqd.onionnovatd4577pzlvdyy42slydhrhru7fpcflbbxlajcmbfrgzyeis6d3id.onionnovaxtychr6ohlc4zr5its73p6i7unpuhpwoodtzrg2y4w4seytatlid.onionnovavagygnhqyf7a5tgbuvmujve5a2jzgbrq2n4dvetkhvr2zjg27cad.onioncold4.gofile.ionovag4k2te3mstt2xq5irywlpaw6edgkpiwgg4t2q7eecisj2qqtvbid.onionnovak6fgohb7m6nm52lgpaaquntawixqsnpcptomwaiiz4mfydztatqd.onionnovav75eqkjoxct7xuhhwnjw5uaaxvznhtbykq6zal5x7tfevxzjyqyd.onioncold3.gofile.iocold-na-phx-7.gofile.io
Nova questions
Is Nova still active?
Yes. Nova posted its most recent victim on July 27, 2026. That's 18 victims in the last 30 days.
How many victims has Nova claimed?
Nova has named 166 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 133 of them were posted in the last 12 months.
When did Nova first appear?
The first victim we recorded for Nova was posted on January 6, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Nova target?
Technology accounts for the most victims we can classify, with 25. Manufacturing follows at 24. We could identify a sector for 134 of 166 victims, so treat this as the shape of the targeting rather than a full census.
Has Nova already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.