Saude Fortaleza Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What is known is limited. On November 15, 2025, the ransomware group nova listed Saude Fortaleza on its leak site and stated that internal files had been taken during a ransomware operation. No figure for the number of individuals affected has been released, and the precise contents of the files have not been described publicly. The practical consequence is that records held by a municipal health authority in Brazil may now circulate outside the organisation that collected them. Residents who have interacted with the Secretaria Municipal de Saude de Fortaleza have no confirmed way, at present, to determine whether their information is among the material claimed to have been removed.

What happened

The incident was first noted through a listing placed by the group nova on November 15, 2025. The entry asserts that internal files were exfiltrated in the course of a ransomware attack. No independent confirmation of the volume of data, the encryption status of systems, or the timeline of events has been made public. The number of people whose records may be involved remains undisclosed.

Inside nova

Nova is a ransomware operation that maintains a public leak site where it lists organisations it claims to have targeted. The group typically states that data were copied before encryption and threatens to release the material if a ransom demand is not met. Its listings have included entities in multiple countries and sectors; each entry on the site represents the group’s own assertion rather than a verified event.

Who is Saude Fortaleza?

Saude Fortaleza refers to the Secretaria Municipal de Saude de Fortaleza, a municipal health authority based in Fortaleza, Brazil. Public records describe the entity as operating in the custom software and IT services sector, with between 20 and 49 employees and annual revenue estimated between 10 million and 25 million. Its responsibilities include the administration of local public-health services, which ordinarily involves the collection and storage of patient and administrative records.

The information in question

The only detail released is that internal files were removed. No inventory of file types, patient identifiers, or administrative documents has been published. Organisations of this kind routinely hold medical histories, appointment data, laboratory results, staff records, and financial or procurement information. The exact scope of the material claimed in this case is unconfirmed.

What's at stake

For individuals, the main concern is the possible circulation of health-related or administrative records that were previously held under municipal control. Such records can be used for identity-related activity or to target people with tailored scams. For the organisation, the incident adds to the operational and legal workload that follows any confirmed or alleged loss of internal material, including the need to assess regulatory obligations under Brazilian data-protection rules.

If your data was in this claimed breach

Residents who have used services provided by the Secretaria Municipal de Saude de Fortaleza can take the following steps while further details remain unavailable:

• Review statements from banks, health insurers, and government portals for unexpected activity.
• Enable or strengthen multi-factor authentication on accounts that may be linked to the municipal health system.
• Request a copy of any personal data held by the authority under applicable access rights.
• Run a free exposure scan of their email address against known breach repositories to check for prior appearances of the same address.

AICompiled with AI assistance from public sources and published under our editorial standards.