Clinical Diagnosis [Deleted thread after 2 days] Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 22 August 2025 the ransomware group nova listed an organisation identified as Clinical Diagnosis on its leak site, stating that internal files had been taken during a ransomware attack. The listing itself was removed after two days. For anyone who has received care or services from a clinical-diagnosis provider, the immediate practical question is whether personal, medical or administrative records were among the material taken and whether those records remain at risk of wider exposure.

Public detail is limited. The number of people affected is unknown, and the precise contents of the files have not been independently confirmed. The group’s own statement asserts that patient data was withdrawn from an initial “Deal,” that only a sample was shown and later deleted, and that the episode was intended as a credibility penalty rather than a full public dump. Those claims remain unverified.

Inside the incident

According to the leak-site entry dated 22 August 2025, nova claimed to have conducted a ransomware attack against Clinical Diagnosis and to have exfiltrated internal files. The group posted a message stating that patient data had been removed from “the first Deal,” that the loss of credibility was the intended punishment for an alleged breach of negotiation terms, and that no data other than a sample—which was subsequently deleted—had been released. The post itself was scheduled for deletion after two days and, according to the listing title, that deletion occurred.

No independent confirmation of the attack method, the volume of data taken, the encryption status of systems, or any ransom demand has been made public. The number of individuals whose information may have been involved remains unknown. The only concrete assertions available are those contained in the group’s own short-lived notice.

Inside nova

Nova is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also copying data and threatening to publish it if payment is not made. Like other groups of this type, it maintains a leak site on which it lists victims, posts samples, and issues statements. Public reporting on nova has described typical tactics that include initial access through phishing or exploited vulnerabilities, lateral movement, data staging, and the use of custom or commodity ransomware encryptors. The group has previously listed organisations across multiple sectors and has used short-lived posts and sample deletions as part of its negotiation posture.

In this instance the only statements attributed to nova are those appearing in the 22 August 2025 listing. No additional claims specific to Clinical Diagnosis beyond the text of that notice have been independently verified.

Who is Clinical Diagnosis [Deleted thread after 2 days] Listed by nova Ransomware Group?

The organisation appears in public records solely under the designation given in the leak-site entry: Clinical Diagnosis, with the parenthetical note that the thread was deleted after two days. Entities operating under names that include “clinical diagnosis” typically provide laboratory testing, diagnostic imaging, pathology services or related medical-support functions. Such organisations routinely handle patient identifiers, test results, referral information, billing records and, in many jurisdictions, protected health information.

A ransomware incident at a diagnostic provider is consequential because the data held are both sensitive and long-lived. Even if the group’s claim that patient data were not fully released is accurate, the mere fact of unauthorised access can trigger regulatory notification duties, contractual obligations to referring clinicians, and potential disruption of diagnostic workflows that patients rely upon.

The information in question

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No further inventory—such as patient names, medical-record numbers, test results, employee credentials or financial documents—has been disclosed. Organisations of this kind ordinarily store precisely those categories of information, yet the exact contents of the files taken in this incident remain unconfirmed. The group asserted that only a sample was shown and later deleted and that patient data were removed from the initial deal; those assertions have not been independently verified.

What's at stake

For individuals, the primary risks are identity theft, medical-identity fraud, and the possibility that sensitive health details could surface later even if the group currently claims they will not. Diagnostic records can reveal conditions, treatments and personal circumstances that, once public, are difficult to retract. For the organisation the stakes include operational disruption, regulatory scrutiny, loss of referring-physician confidence, and the reputational damage that follows any ransomware listing—regardless of whether a full data dump occurs.

Because the number of people affected is unknown and the precise data types remain undisclosed, the scale of these risks cannot yet be quantified. The short-lived nature of the listing and the group’s claim of sample deletion may reduce immediate public exposure, yet they do not eliminate the underlying compromise or the possibility of later reuse of the material.

Were you affected?

If you have been a patient, employee or business partner of a clinical-diagnosis provider, monitor official notifications from the organisation itself. Change passwords on any related accounts, enable multi-factor authentication where available, and remain alert for unexpected medical bills or identity-related activity. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Any further Reported Details will depend on official statements from the organisation or from regulators once they become available.

AICompiled with AI assistance from public sources and published under our editorial standards.