Kedah Listed by Nova Ransomware Group

On June 16, 2026, the Kedah State Government appeared on the leak site of the nova Ransomware Group. The attackers published samples of internal files they claim to have stolen during a ransomware incident, exposing data belonging to a Malaysian state portal used by citizens, local businesses, and tourists for online transactions, government services, and tourism information.

What Public Reporting Shows

Public reporting indicates that nova Ransomware Group listed the Kedah State Government on its dark web leak page. The group provided a tree of stolen data and sample files as proof of exfiltration. The affected system is the official corporate portal operated by the Kedah State Government, which handles citizen services, customer satisfaction surveys, policy updates, tourism information, education resources, and corporate financing tools.

Available reporting describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. The exact number of individuals affected remains unknown. No specific deadline for payment or further data publication has been confirmed in the samples reviewed by researchers.

Why This Matters for You and Your Family

When a government portal like Kedah’s is breached, ordinary residents and their families can find their personal information exposed. Data commonly held in such systems — names, identification numbers, contact details, transaction records, and addresses — can be used for identity theft, phishing, or financial fraud. If you or your family have used the portal for any official service, your information may now be in the hands of criminals.

Credential leaks from government services often cascade into other accounts. The same email and password combination used for a state portal is frequently reused for banking, email, or social media. Children’s school-related accounts or family gaming profiles linked to the same household details can also become targets.

The Doxxing and Identity-Chain Implications

Once attackers obtain government records, they can map connections between official identities and online handles. This creates an identity chain that links your real name, address, phone number, and email to gaming usernames, social media profiles, and family member accounts. The result is accelerated doxxing that can lead to harassment, targeted scams, or physical risk.

Children’s gaming accounts are particularly vulnerable in these chains because parents often use the same email or recovery phone number for both official services and family gaming logins. A single breach can therefore expose an entire household’s digital footprint.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, with cleanup handled by the service.
• Rotate any password you used on the Kedah portal anywhere it has been reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or contact details.
• Let remediation specialists perform hands-on takedown requests across data brokers and exposed records on your behalf.

The nova Ransomware Group first gained attention in late 2024 and has since targeted organizations across multiple sectors with a consistent playbook of initial access through phishing or unpatched vulnerabilities, followed by data exfiltration and extortion via leak sites. Public reporting attributes earlier victims to them in healthcare, education, and local government entities. Their typical approach involves publishing sample files to pressure payment, then threatening full data release if demands are not met.

Incidents like the Kedah breach show that government systems holding everyday citizen data remain attractive targets. Protecting yourself and your family requires more than changing one password. Start by understanding exactly where your information appears online and take deliberate steps to break the chains attackers rely on. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, including coverage for your household and children’s gaming accounts that are often the weakest link in these attacks.