Rumah Sakit Universitas Indonesia (RSUI) Listed by nova Ransomware Group

On July 20, 2026, Indonesian teaching hospital Rumah Sakit Universitas Indonesia (RSUI) appeared on the leak site operated by the nova Ransomware Group. The listing states that internal files were exfiltrated during a ransomware attack. The hospital, which serves as the University of Indonesia’s primary clinical facility for advanced medical care, education, and research, has not yet published a public breach notification detailing the exact scope or number of records involved.

Confirmed Details from the Leak Site

The nova leak site listing indicates that RSUI suffered a ransomware intrusion in which attackers successfully exfiltrated internal files. It does not quantify the volume of data taken or name specific databases compromised. The group has published a partial tree of stolen material and states that additional samples will be provided to the hospital only after contact is made with its support department. The disclosure does not confirm whether patient medical records, employee personal data, or research files were included, though the nature of a teaching hospital makes such information a realistic possibility. No ransom amount or payment deadline is publicly listed on the page.

Why This Matters for You and Your Family

When a hospital’s internal systems are breached, the people most directly affected are patients, their families, current and former staff, and students connected to the university’s medical programs. Even without an exact count, any exposed records can contain names, dates of birth, national ID numbers, addresses, treatment histories, insurance details, and contact information. In Indonesia these details are frequently linked to the national healthcare system and government databases, increasing the chance that one breach can accelerate further identity compromise. If your family has received care at RSUI or you have a relative who works or studies there, your personal information may now sit in an attacker-controlled archive.

Doxxing and Identity-Chain Risks

Medical data carries unusually high doxxing value because it often links real-world identity to addresses, phone numbers, family relationships, and financial responsibility for treatment. Attackers routinely chain this information with credentials stolen from other breaches to take over email accounts, government portals, banking apps, and social-media profiles. A single exposed hospital record can become the anchor for an entire identity profile that follows an individual or household for years. Credential leaks like this one cascade into account takeovers, especially for gaming accounts belonging to children or teenagers who share devices or family email addresses. Once initial access is gained, extortion threats can shift from the institution to individuals whose sensitive health details are now public.

Nova Ransomware Group Track Record

Public reporting attributes nova as a relatively new ransomware operation that emerged in late 2024. The group typically gains initial access through phishing, remote-desktop protocol brute-force attacks, or exploitation of unpatched VPN appliances. After exfiltration, nova follows a double-extortion model: it threatens to publish stolen data unless the victim pays, then lists non-paying targets on its dark-web leak site with proof files and contact instructions. Prior victims have included manufacturing firms, logistics companies, and smaller healthcare providers across Southeast Asia and Latin America. The group’s playbook emphasizes steady pressure through partial data leaks and direct outreach to the victim’s support staff rather than broad public shaming.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly where RSUI-related data may surface.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Rotate any password you have ever used at RSUI, the University of Indonesia, or related medical portals, and secure those accounts with 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently chain back to the same addresses and parent emails exposed in healthcare breaches.
• Let remediation specialists handle data-broker takedown requests and persistent leak-site references on your behalf while you focus on securing day-to-day accounts.

The RSUI incident illustrates how quickly a single hospital breach can feed long-term identity and financial risk for thousands of ordinary families. Acting promptly on the exposure while it is still fresh limits how far attackers and downstream data brokers can travel with your information. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give you a practical way to close those gaps for yourself and everyone at your address. Start your DoxxScan trial today.