CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Nova

actor · actor:nova-raas

Ransomware-as-a-service operation using the RaLord ransomware, which threatened in July 2025 to leak data stolen from the Dutch laboratory Clinical Diagnostics (GovInfoSecurity, 2025-09-03).

Coverage
1
first 2026-05-14 → last 2026-10-21
Latest activity
2026-05-14
Dutch inspectorate finds the hacked cervical-screening lab ran no NEN 7510 audit or periodic risk assessment
Peak priority
notable
1 notable
Targets
healthcare
sectors: healthcare · regions: europe
Sources cited
3
3 hosts

Defender insights

What each entry about Nova tells a defender to do, newest first.

2026-05-14NOTABLEDutch inspectorate finds the hacked cervical-screening lab ran no NEN 7510 audit or periodic risk assessment

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed activity

Story timeline

  1. 2026-05-14Dutch IGJ: Clinical Diagnostics labs failed NEN 7510 at the time of the July 2025 Nova breach, which reached data of about 941,000 people through an account without MFA in unmonitored legacy systems
    active-threatsDutch inspectorate finds the hacked cervical-screening lab ran no NEN 7510 audit or periodic risk assessment

Hunting pivots

Tags
data-breachpolicyransomware
ATT&CK techniques (2 across 5 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts
  • PersistenceValid Accounts
  • Privilege EscalationValid Accounts
  • StealthValid Accounts
  • ImpactFinancial Theft

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-14/dutch-igj-rules-clinical-diagnostics-nmdl-failed-nen-7510-in · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-14/dutch-igj-rules-clinical-diagnostics-nmdl-failed-nen-7510-in · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-14/dutch-igj-rules-clinical-diagnostics-nmdl-failed-nen-7510-in · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-14/dutch-igj-rules-clinical-diagnostics-nmdl-failed-nen-7510-in · ATT&CK page ↗

Impact TA0040

T1657Financial Theft×1

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Evidence: 2026-05-14/dutch-igj-rules-clinical-diagnostics-nmdl-failed-nen-7510-in · ATT&CK page ↗

Entries about Nova (1)

2026-05-14 · view entry permalink →

NOTABLEupdatedNATOA2

Dutch IGJ: Clinical Diagnostics labs failed NEN 7510 at the time of the July 2025 Nova breach, which reached data of about 941,000 people through an account without MFA in unmonitored legacy systems

The Dutch Health and Youth Care Inspectorate (IGJ) concluded on 2026-05-13 that the business units Clinical Diagnostics LCPL BV and NMDL BV in Rijswijk "did not meet the standard either at the time of the hack or during an inspection visit in December 2025" (translated from Dutch): among other gaps, no independent audit of information security had been carried out and processing risks had not been mapped periodically, so the company could not determine which data-security measures it needed (IGJ, 2026-05-13). The Wabvpz requires organisations working with patient data to meet NEN 7510, and IGJ says working to the norm could have reduced the likelihood of an incident like this and limited its consequences (IGJ, 2026-05-13).

Computable reports from the inspection that the company could not establish how the attackers gained access to the compromised user account, which had a 16-character password but no active multi-factor authentication, and that the legacy environments the attackers entered had dropped out of the security operations centre's monitoring through human error, because the SOC wrongly believed them inactive, so anomalous patterns in the logs went unnoticed (Computable, 2026-05-13). Data of about 941,000 people, mostly cervical-cancer screening participants, was viewed or stolen, and Computable reports that the company paid a ransom (Computable, 2026-05-13). The ransomware-as-a-service group Nova had threatened in July 2025 to leak the data, and the screening agency said the lab could not confirm that 941,000 was the full extent (GovInfoSecurity, 2025-09-03).

IGJ asked the company to demonstrate NEN 7510 compliance at short notice; under the Wabvpz it cannot impose punitive measures, while the Dutch data protection authority (AP), which is investigating under the GDPR, can, and the company says an external audit came out positive and certification is expected soon (IGJ, 2026-05-13). IGJ is using the case to call on healthcare providers to work demonstrably to NEN 7510, with a certificate or an independent assessment, and to check actively that the labs and other third parties they use comply (Computable, 2026-05-13).

The investigation shows that the business units of Clinical Diagnostics involved did not meet the standard either at the time of the hack or during an inspection visit in December 2025. (translated from Dutch)

Working according to this standard could have reduced the likelihood of an information security incident like this and limited the consequences. (translated from Dutch)

Under the Wabvpz the IGJ cannot impose punitive measures. The AP can do so under the GDPR. (translated from Dutch)

IGJ 2026-05-13

However, no multi-factor authentication turned out to be active on the affected account. (translated from Dutch)

Computable 2026-05-13
Correctionrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationentitiesevidenceheadlineprioritysourcessourcing_notesummarytagstechniquestitle

IGJ asked Clinical Diagnostics to demonstrate NEN 7510 compliance at short notice rather than demanding certification, and the company reports a positive external audit with certification expected soon (IGJ, 2026-05-13). IGJ's release speaks of a data hack and an inspection visit in December 2025; it says working to the norm could have reduced the likelihood of such an incident and limited its consequences, not that the breach scale was their proximate result, and it states no relationship to ISO/IEC 27001 (IGJ, 2026-05-13). The call on all healthcare providers to prove NEN 7510 compliance, including at the labs they use, is reported by Computable from the inspection (Computable, 2026-05-13). Ransomware by Nova and the figure of 941,000 come from press reporting, and the screening agency said the lab could not confirm that this was the full extent (GovInfoSecurity, 2025-09-03).

No cited source compares NEN 7510 with Switzerland's electronic patient record rules or describes the security of Swiss providers. Computable's account of the inspection adds the access vector, a compromised account without multi-factor authentication in legacy environments that had dropped out of SOC monitoring (Computable, 2026-05-13).

incident14 May 05:00Zmulti-sourceOpen finding →
Sources: IGJ · Computable · GovInfoSecurity

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • computable.nl1 (33%)
  • govinfosecurity.com1 (33%)
  • igj.nl1 (33%)
All cited sources (3)