FysioRoadmap Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target specialised healthcare software providers, where patient records and national identity numbers create high-value pressure points for extortion. In this landscape, the listing of FysioRoadmap by the nova ransomware group fits a familiar pattern of claims posted on leak sites without independent public confirmation of every detail.

Public reporting on 28 September 2025 stated that FysioRoadmap, a Dutch physiotherapy electronic patient dossier (EPD) package, had been listed by nova. The number of people affected remains unknown. The group claims it exfiltrated internal files; exact contents and verification of the claim have not been independently confirmed in the available record.

What happened

According to the reported summary, FysioRoadmap was listed by the nova ransomware group on or around 28 September 2025. The listing characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. Public detail on the precise intrusion method, the date of initial access, or any ransom demand is limited. The number of individuals affected is unknown. The group claims it stole 10 GB of data containing more than 20 000 documents that include BSN numbers (the Dutch national citizen service number). These figures and the presence of BSN data are presented solely as the group’s assertion on its leak site; they have not been corroborated by independent public sources in the facts available.

Inside nova

Nova is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also claiming to steal data and threatening to publish it if payment is not made. Like many such groups, it maintains a dark-web leak site where it posts victim names, sample files or volume claims to increase pressure. Public reporting on nova has described it as opportunistic rather than exclusively focused on any single sector, though healthcare-adjacent organisations appear periodically among its listings. The group’s statements about any specific victim, including volume of data or types of documents, remain unverified claims until confirmed by the organisation or by independent forensic disclosure. In this case the listing of FysioRoadmap and the accompanying 10 GB / 20 000-document assertion should be treated as such a claim.

About FysioRoadmap

FysioRoadmap is a software package developed as part of Monitored Rehab Systems. It is designed specifically for physiotherapy practices and functions as an electronic patient dossier that follows the guidelines of the Koninklijk Nederlands Genootschap voor Fysiotherapie (KNGF). The parent company also manufactures rehabilitation hardware such as functional squat devices, back-extension equipment, pulleys, the MR Cube, Easy Slide and Kneelax units. Organisations of this type typically process clinical notes, treatment plans, appointment data, and personal identifiers of patients and therapists. Because the software sits inside the clinical workflow of physiotherapy practices, a breach can affect both the software provider and the practices that rely on it for day-to-day care documentation.

What was likely exposed

The only data category named in the public record is “internal files exfiltrated in a ransomware attack.” The nova group claims the haul amounted to 10 GB and included more than 20 000 documents containing BSN numbers. No independent inventory of file types, patient records, or other personal data has been released. Organisations that supply EPD software for physiotherapy commonly hold or process patient names, dates of birth, contact details, medical histories, treatment notes, insurance or billing identifiers, and national identity numbers such as the BSN. Whether any of those categories were present in the claimed 10 GB set remains unconfirmed. Readers should treat the group’s description as an unverified assertion rather than established fact.

What's at stake

If BSN numbers and clinical documents were in fact taken, affected individuals face elevated risks of identity fraud, social-engineering attacks that exploit medical context, and long-term privacy harm. A BSN is a persistent national identifier used across Dutch government and healthcare systems; its compromise can enable fraudulent claims or account takeovers that are difficult to reverse. For physiotherapy practices that use FysioRoadmap, operational disruption, regulatory notification duties under the GDPR and Dutch health-data rules, and potential loss of patient trust are concrete consequences. The organisation itself may face investigative costs, contractual obligations to customers, and reputational damage regardless of whether the full extent of the group’s claims is later verified.

What to do if you're exposed

Anyone who has been a patient or staff member at a practice using FysioRoadmap should monitor official statements from Monitored Rehab Systems or the practice itself for confirmed notifications. In the meantime, treat unsolicited requests for personal or medical information with heightened caution, enable multi-factor authentication on email and government portals where available, and consider placing fraud alerts with relevant Dutch credit or identity-protection services. Review bank and insurance statements for unexpected activity. As a practical first check, readers can run a free exposure scan of their email address to see whether that address has already appeared in known breach data sets; such a scan does not confirm involvement in this specific incident but can surface other exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.