Sunass Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations targeting public-sector entities remain a persistent feature of the threat landscape, with groups frequently claiming to have compromised organisations responsible for essential services. On June 16, 2026, the nova ransomware group listed Sunass on its leak site, stating that internal files had been exfiltrated during a ransomware attack. The number of people affected and the precise scale of any data exposure remain undisclosed.

Inside the incident

The incident came to light through the group’s public listing rather than an official announcement from Sunass. No Reported Details have been released about the date of the intrusion, the initial access method, or the volume of material taken. The only information provided is that internal files were removed and that the listing appeared on June 16, 2026. Public records do not yet indicate whether any data has been published or whether Sunass has confirmed the claims.

The group behind it: nova

Nova is a ransomware operation that maintains a leak site to list victims and, in some cases, to publish stolen material. Such groups commonly employ double-extortion tactics, encrypting systems and threatening to release data unless a ransom is paid. Their listings are presented by the group itself and should be treated as unverified claims until corroborated by the affected organisation or independent investigation. Nova has previously appeared in connection with incidents across multiple sectors, though specific tactics used against any single victim are rarely confirmed publicly at the time of listing.

Sunass and its sector

Sunass is a Peruvian public regulatory body established by Law Decree No. 25965. It holds legal personality and operates with administrative, functional, technical, economic and financial autonomy. Its mandate covers the regulation and oversight of water supply and sanitation services, including work with providers in rural areas and smaller cities as well as public education campaigns on water conservation. Organisations of this type routinely handle operational records, regulatory correspondence and contact information related to service providers and citizens.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No further breakdown of file categories or data fields has been published. Organisations in the water-regulation sector typically maintain records on service contracts, compliance reports, technical inspections and limited personal contact details, yet the exact contents of the material claimed by the group remain unconfirmed.

The real-world impact

Exposure of internal regulatory files could affect operational continuity and the confidentiality of communications between the regulator and service providers. Where personal contact information is involved, individuals may face increased risk of unsolicited contact or phishing. For the organisation, the incident adds to the administrative burden of assessing scope, notifying relevant authorities and restoring systems, even when the full extent of any data release is still unknown.

What to do if you're exposed

Individuals who believe their information may be involved should monitor official statements from Sunass and any guidance issued by Peruvian data-protection authorities. Practical first steps include changing passwords for any accounts linked to the organisation, enabling multi-factor authentication, and reviewing recent statements or correspondence for signs of misuse. Readers can run a free exposure scan of their email address to check whether their information has surfaced in known breach data.

• Review bank and service-provider statements for unusual activity
• Enable multi-factor authentication on all accounts
• Monitor official Sunass communications for further updates

AICompiled with AI assistance from public sources and published under our editorial standards.