Softseba Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations across the technology sector, often publicising incidents through dedicated leak sites as part of their operations. On 21 May 2026, the group known as nova listed Softseba on its platform, claiming to have carried out a ransomware attack that resulted in the exfiltration of internal files. Public information on the number of individuals affected or the precise contents of any data remains unavailable at this time.

The incident highlights the ongoing exposure of software providers to data theft, where even limited public disclosure can raise questions for clients and partners who rely on such firms for development and hosting services. Details beyond the initial listing have not been confirmed by independent sources.

Breaking down the breach

The only confirmed public record is the listing itself on 21 May 2026. The group states that internal files were removed during a ransomware operation. No information has been released on the number of records involved, the timeline of the intrusion, or the specific attack vector used. The scale of any impact on individuals or client organisations is therefore unknown.

The group behind it: nova

Nova is a ransomware operator that maintains a public listing of claimed victims. Such groups typically gain initial access through common vectors such as compromised credentials or unpatched systems, then move laterally before deploying encryption and exfiltrating data. Their listings serve as a pressure tactic on targeted organisations. No independent verification of the Softseba claim has been reported beyond the group’s own site.

About Softseba

Softseba describes itself as a software development company with five years of experience, offering services in web and mobile application development, cloud computing, and artificial intelligence. It states that it works with businesses of varying sizes and emphasises delivery within agreed timelines and budgets. Organisations in this sector routinely process source code, project documentation, and client-related records as part of their operations.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of file types or data categories has been provided. Software development firms commonly hold code repositories, configuration details, and correspondence with clients, yet the exact material removed in this case remains unconfirmed. Any assessment of specific data elements would require information that has not been disclosed.

The real-world impact

Where internal files are taken, affected organisations may face follow-on risks such as misuse of proprietary material or attempts to contact clients directly. Individuals whose information appears in those files could encounter targeted phishing or account compromise attempts. For the company itself, the incident may require extended investigation, notification obligations, and remediation work, though the absence of confirmed data volumes makes the full scope difficult to quantify at present.

Were you affected?

Individuals can begin by monitoring their email accounts and financial statements for unusual activity. Changing passwords for any services linked to Softseba and enabling multi-factor authentication where available are standard first measures. Readers may also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public listings. Organisations should contact Softseba directly for any official statements on the incident.

AICompiled with AI assistance from public sources and published under our editorial standards.