Dansoft Listed by nova Ransomware Group

On July 13, 2025, Danish software company Dansoft appeared on the leak site of the nova Ransomware Group. The listing states that internal files were exfiltrated during a ransomware attack on the firm, which has developed ERP and enterprise software systems for customers across multiple industries since shifting from defense projects in the late 1980s.

Reported Details from Reports

Public reporting indicates the nova Ransomware Group added Dansoft to its leak site on July 13, 2025. The company, founded in 1989, originally worked on defense-related projects before pivoting to commercial ERP platforms, cloud hosting, and IT executive services. Available reporting describes the exposed material as internal files, though the exact volume and specific data types remain unconfirmed in initial listings. No precise victim count for individuals has been released, but any customer or employee whose information passed through Dansoft’s systems could be affected.

The leak site is hosted on the dark web, a common tactic used by ransomware operators to pressure victims into payment. As of the publication of this article, it is unclear whether Dansoft has engaged with the group or if any deadline for payment has been set.

Why This Matters for You and Your Family

When a company that handles business records, employee details, or client information is breached, the ripple effects reach ordinary people. If you or your family members have worked with a Dansoft customer, used one of their ERP systems, or had personal data processed through their cloud hosting services, your information may now sit in an attacker’s archive. Internal files often contain spreadsheets, contracts, email exports, and configuration data that can expose names, addresses, phone numbers, and financial details.

Once that information leaves the company’s control, it can be sold, traded, or used to target you directly. For families this means higher risk of identity theft, unexpected loan applications in your name, or phishing emails that reference real business relationships you never knew were compromised.

The Doxxing and Identity-Chain Risk

Ransomware leaks rarely stop at one dataset. Attackers frequently cross-reference stolen internal files with other breaches to build detailed profiles. A work email from a Dansoft-related system can be linked to your personal accounts, social-media handles, or even your children’s gaming usernames if those credentials were reused. This creates an identity chain that turns a single corporate breach into long-term personal exposure.

Credential leaks like this one often cascade into account takeovers. Once attackers control one of your accounts, they hunt for linked services, reset passwords, and gather even more data. Gaming accounts belonging to children are especially vulnerable because they frequently share the same email address or password patterns used for school or family logins.

Nova Ransomware Group’s Known Activity

Public reporting attributes the attack to the nova Ransomware Group. The group emerged in early 2024 and has since listed dozens of organizations on its leak site. Notable prior victims include mid-sized manufacturing, logistics, and technology-service firms. Their typical playbook involves gaining initial access through phishing or exploited remote-desktop services, exfiltrating data before deploying ransomware, and then publishing samples on their onion site if the target does not pay. Extortion demands usually combine a ransom for decryption with a separate fee to prevent publication of the stolen files.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, then complete the cleanup of exposed records.
• Rotate any password you used at Dansoft or any of its customer systems anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts often chained to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and suspicious sites on your behalf while you focus on securing day-to-day accounts.

The incident shows that corporate breaches continue to outpace traditional defenses and that ordinary families bear the real cost. Taking concrete steps now can limit how far attackers travel down the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to the same credential-stuffing attacks seen after incidents like Dansoft.