University of Gävle Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 15, 2025, the University of Gävle appeared in a listing published by the nova ransomware group. The entry states that internal files were exfiltrated during a ransomware attack on the Swedish institution, though the scale of any data removal, the number of individuals affected, and confirmation of the incident by the university itself have not been publicly detailed. The listing constitutes a claim by the group rather than an independently verified account of events.

What happened

The available information is limited to the nova group’s public listing on November 15, 2025. That listing asserts that internal files were taken from the University of Gävle in connection with a ransomware operation. No official statement from the university, no confirmed count of records or files, and no description of the intrusion method have been released. The number of people potentially affected is recorded as unknown.

Inside nova

Nova is a ransomware group that has conducted operations against organisations in multiple countries. Its documented pattern involves gaining access to target networks, exfiltrating data, and then demanding payment while threatening to publish the material if the demand is not met. The group maintains a leak site where it lists victims and, in some cases, posts samples of claimed data. Attribution in any single case rests on the group’s own statements unless corroborated by the victim or independent investigators.

Who is University of Gävle?

The University of Gävle is a public university college in Gävle, Sweden. It was established in 1977 and is organised into three academies and nine departments. The institution provides approximately 45 master’s and bachelor’s degree programmes along with roughly 800 individual courses spanning technology, social sciences, natural sciences, and the humanities. Like other higher-education bodies, it maintains administrative records, student information systems, research data, and staff files.

What was likely exposed

The only data category named in the listing is internal files. The precise nature, volume, or sensitivity of those files has not been disclosed. Universities routinely process personal data on students and staff, financial records, research materials, and operational documents; however, whether any of these categories were among the files referenced remains unconfirmed.

Why it matters

Even without Reported Details on the contents, the exposure of internal university files can create downstream risks for individuals whose information is held by the institution. Students and employees may face increased chances of targeted phishing, identity misuse, or unauthorised access to academic or employment records. For the organisation, the incident adds to the administrative burden of incident response, regulatory notification requirements under Swedish and EU data-protection rules, and potential loss of trust among applicants and research partners.

If your data was in this claimed breach

Individuals who have studied or worked at the University of Gävle should monitor their email accounts and financial statements for unusual activity. Enabling multi-factor authentication on university-related and linked personal accounts reduces the chance of credential misuse. A free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in previously published collections, providing a starting point for further checks.

AICompiled with AI assistance from public sources and published under our editorial standards.