SPZC Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
SPZC was listed by the nova ransomware group on December 19, 2025, after internal files were exfiltrated in a ransomware attack. Anyone connected to SPZC should check whether their information was exposed and take appropriate protective steps.
What happened
The incident came to public notice when SPZC was added to a listing maintained by the nova group on December 19, 2025. The listing asserts that files were taken from the organization in the course of a ransomware operation. No further details on the timing of the intrusion, the volume of data, or the method of access have been released by either the group or the organization.
The group behind it: nova
Nova is a ransomware operation that maintains an online listing of claimed victims and has been publicly linked to encryption and data-exfiltration campaigns against organizations in multiple countries. The group presents its listings as evidence of successful intrusions. In the case of SPZC, the entry constitutes the group's claim of responsibility; independent confirmation of the underlying events has not been published.
About SPZC
SPZC is a Portuguese trade union that represents education workers. Its activities include defending members' employment rights, coordinating industrial action such as strikes, and distributing information on careers and working conditions within the education sector. Organizations of this type routinely maintain records on members, internal communications, and negotiations with employers.
The information in question
The listing describes the exfiltration of internal files. No inventory of specific documents, file categories, or data fields has been made public. While unions in the education sector commonly hold membership details, correspondence, and records related to workplace issues, the exact nature of the material allegedly taken from SPZC has not been confirmed.
What's at stake
Exposure of internal files from a trade union can reveal details of ongoing negotiations, member identities, or internal deliberations. Such information may be used for targeted follow-on activity against individuals or the organization itself. The absence of confirmed data volumes or categories means the scale of any downstream impact cannot yet be assessed.
If your data was in this claimed breach
Individuals who are members of SPZC or who have corresponded with the organization should monitor their email and other accounts for unusual activity. Basic protective steps include changing passwords for any accounts that may have been referenced in union records and enabling multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
National Institute of Materials Physics Listed by nova Ransomware GroupUniversity of Gävle Listed by nova Ransomware GroupUniversite de Pau et du Pays de lAdour Listed by nova Ransomware GroupEnsemble Montplaisir Listed by nova Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the SPZC Listed by nova Ransomware Group →
Publicly posted by nova — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.