Dephub Listed by nova Ransomware Group: What Was Exposed & What To Do

On July 19, 2026, the organisation Dephub was listed by the ransomware group nova, which claims to have carried out a ransomware attack involving the exfiltration of internal files. Public reporting ties Dephub to the Directorate of Shipping and Maritime Affairs at Jl. Medan Merdeka Barat No. 8, Jakarta, Indonesia 10110. The number of people affected remains unknown, and wider technical detail about the incident has not been disclosed.

Listings of this kind matter because they signal that an attacker asserts control over an organisation’s data and may threaten to publish or misuse it. Until independent confirmation is available, the listing should be treated as a claim rather than established fact. What follows summarises only what has been reported and the practical implications for anyone who may be connected to the organisation.

Breaking down the breach

According to the available record, Dephub was listed by nova on or about July 19, 2026. The reported description states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of systems involved, or the precise date the intrusion began. The method of initial access, any ransom demand, and whether systems were encrypted as well as copied are all undisclosed.

The record does not confirm whether the listing was accompanied by sample files, a countdown, or full publication. People affected are recorded as unknown. In short, the concrete public facts are limited to the victim name, the claiming group, the report date, the characterisation of the data as internal files taken in a ransomware incident, and the organisational address associated with the Directorate of Shipping and Maritime Affairs in Jakarta.

Who is nova?

Nova is a ransomware group known in open reporting for double-extortion style operations: encrypting or disrupting systems while also copying data and threatening to leak it if demands are not met. Like other groups in this category, nova has historically advertised victims on dedicated leak sites, using those listings to apply pressure. Public analyses of such actors commonly describe opportunistic targeting across sectors, use of commodity and custom tools, and negotiation conducted through dark-web channels.

For this incident, the only specific assertion in the record is that nova listed Dephub and described internal files as exfiltrated. No further statements attributed to the group about this victim—such as claimed file counts, screenshots, or motives—are included in the facts. The listing itself remains an unverified claim unless and until the organisation or independent investigators confirm the intrusion and the data loss.

About Dephub

Dephub is identified in the reporting with the Directorate of Shipping and Maritime Affairs, located at Jl. Medan Merdeka Barat No. 8, Jakarta, Indonesia 10110. Organisations of this type typically sit within a national transport or maritime administration. Their work commonly covers vessel registration, seafarer documentation, port and shipping oversight, safety and compliance records, and coordination with industry and other government bodies.

A breach affecting such a directorate is consequential because the institution holds operational and personal information tied to maritime commerce, regulation, and the people who work in or depend on the sector. Disruption or exposure can affect administrative continuity, trust in official records, and the privacy of individuals whose details appear in licensing, inspection, or correspondence systems. The facts do not state that any particular system was confirmed compromised beyond the group’s claim of internal-file exfiltration.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of file types, databases, or record categories has been published in the material provided. Exact contents therefore remain unconfirmed.

Directorates responsible for shipping and maritime affairs ordinarily maintain a mix of administrative and regulated data. That can include staff and contractor records, correspondence, vessel and operator files, inspection and compliance documents, and identity-related information used for licensing or certification. None of those categories should be read as confirmed in this incident; they illustrate what is typically at stake in the sector when internal files are claimed to have been taken. Until a fuller disclosure or official notice appears, the precise data at risk cannot be stated as fact.

What's at stake

For individuals, the main risks from an unverified but claimed exfiltration of internal government or quasi-governmental files are misuse of personal or professional details, targeted phishing that references real administrative context, and longer-term exposure if documents later appear in secondary leaks or criminal markets. Employees, contractors, seafarers, vessel operators, and correspondents whose information sits in such systems could face identity or credential abuse even when the full scope is still unknown.

For the organisation, stakes include operational disruption if systems were encrypted or taken offline, regulatory and public-accountability pressure, and the cost of investigation, containment, and notification. Reputation and trust in official maritime records can also be affected when a ransomware group publicly lists the institution. None of these outcomes is confirmed by the sparse public record; they are the ordinary consequences that follow when internal files are alleged to have left an organisation’s control.

If your data was in this breach

Because the number of people affected and the exact data types remain unknown, treat any connection to Dephub or the Directorate of Shipping and Maritime Affairs as a reason for heightened caution rather than proof of compromise. Practical first steps include:

• Monitor official notices from Dephub or Indonesian maritime authorities for confirmation and guidance.
• Be alert to phishing or social-engineering attempts that reference shipping, licensing, or Jakarta administrative details.
• Change passwords on related accounts, enable multi-factor authentication where available, and avoid reusing credentials.
• Review financial and identity alerts if you have supplied personal documents to the organisation.
• Run a free exposure scan of your email to check whether your information has already surfaced in known breach data sets.

Public detail on this incident is still limited. Rely on primary notices from the organisation itself when they appear, and treat the nova listing as a claim until it is independently verified.

AICompiled with AI assistance from public sources and published under our editorial standards.