Kedah Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Kedah was listed by the nova ransomware group on June 16, 2026, with internal files reported as exfiltrated; the date of the intrusion has not been established. Individuals should check whether their information was exposed and take appropriate protective steps.
Inside the incident
The incident involves the official corporate portal operated by the Kedah State Government. The portal supplies public information and services such as online transactions, customer surveys, and updates on government policies, with sections covering tourism, education, and corporate financing. The listing by nova indicates that files were removed from the environment, and the group states it can supply a directory structure along with samples of the material. No further technical details on the initial access method or the duration of the operation have been released.
The group behind it: nova
Nova is a ransomware operator that maintains a leak site to publish names of organisations it claims to have targeted. The group typically combines encryption of systems with the removal of data, then uses the site to pressure victims. Public records of its activity show repeated use of this pattern against government and corporate targets, though each listing remains a claim until independently verified.
Kedah and its sector
Kedah is a Malaysian state whose government portal serves residents, local businesses, and visitors. Entities of this type routinely manage records that support public services, licensing, tourism promotion, and administrative correspondence. A compromise at this level can affect both the delivery of those services and the trust placed in official digital channels.
What data was at risk
The only confirmed detail is that internal files were removed. The exact categories of information contained in those files have not been published. Government portals of this nature commonly process personal identifiers, contact details, transaction records, and policy documents, yet the specific contents taken in this case stay unconfirmed.
- Monitor official statements from the Kedah State Government for any later disclosure of data categories.
- Review account activity on any services accessed through the portal.
The real-world impact
Individuals whose information appears in the exfiltrated files could face risks of targeted phishing or misuse of personal details. The organisation may experience operational disruption while restoring systems and may need to allocate resources to investigation and notification. Because the scale of exposure is unknown, the full extent of these effects cannot yet be measured.
What to do if you're exposed
Residents and businesses that interact with the Kedah portal should watch for unusual account activity and consider enabling additional verification steps on linked services. A free exposure scan of an email address against known breach data can indicate whether an address has appeared in previously published sets. Any official guidance issued by the state government should be followed once released.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
alejandria.biz Listed by nova Ransomware Grouplpgroup Listed by nova Ransomware Groupalejandria Listed by nova Ransomware GroupNhà Thành Phố Listed by nova Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Kedah Listed by nova Ransomware Group →
Publicly posted by nova — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.