University of Gävle Listed by nova Ransomware Group

On November 15, 2025, the University of Gävle in Sweden appeared on the leak site of the nova ransomware group. Internal files were allegedly exfiltrated during a ransomware attack on the institution, which serves thousands of students, faculty, staff, and alumni whose personal and academic records may now be at risk.

What's Publicly Reported from Reporting

Public reporting indicates the University of Gävle, established in 1977 and organized into three academies and nine departments, was listed on the nova ransomware group’s public leak portal. The primary source is the group’s onion site, mirrored by ransomware.live. Available reporting describes the exposed material as internal files exfiltrated during the attack. The exact number of individuals affected remains unknown, and the specific types of records have not been publicly detailed beyond the broad category of internal university documents.

The university offers approximately 45 degree programmes and 800 courses across technology, social sciences, natural sciences, and the humanities. Its domain, hig.se, and associated ZoomInfo records confirm it as a mid-sized Swedish higher-education institution whose operational data may now be in the hands of the threat actors.

Why This Matters for You and Your Family

If you or any member of your family attended, worked at, or applied to the University of Gävle, your personal information may have been caught in this breach. Student records, employee files, alumni databases, and correspondence frequently contain full names, dates of birth, national identification numbers, addresses, phone numbers, and email accounts. Once such data leaves institutional control, it can be sold, traded, or used to target you directly.

Credential leaks like this one often cascade far beyond the original victim. A university email address reused on personal services, combined with a password or security question tied to family details, creates a direct path to your bank accounts, social media, or children’s online profiles.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at dumping raw files. They map relationships between leaked records to build detailed identity chains. A single exposed university document can link your email address to your home address, phone number, children’s names, and even gaming usernames. These connections allow attackers to launch credible extortion campaigns or sell ready-made dossiers on dark-web markets.

Public reporting on similar incidents shows that once initial data appears, follow-on leaks frequently surface weeks or months later as opportunistic criminals exploit the original breach. For families, this risk extends to children’s gaming accounts that reuse the same email or password patterns found in the university files.

Nova Ransomware Group’s Known Track Record

Public reporting attributes nova as a ransomware group that emerged in recent years and has targeted organizations across multiple countries. Notable prior victims include other educational institutions, municipalities, and private companies whose data was allegedly exfiltrated and then published on their leak site when ransom demands went unmet. Their typical playbook involves initial access through compromised credentials or unpatched remote services, followed by exfiltration of sensitive files and extortion pressure that combines data-leak threats with occasional direct contact.

What to do

• Run a DoxxScan to map every link between your university email, personal handles, phone numbers, and real-world identity, with cleanup handled by specialists.
• Rotate any password you ever used at the University of Gävle wherever it has been reused, and immediately enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the entire household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same addresses or parent emails leaked in incidents like this.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your accounts.

The University of Gävle breach is a reminder that data stolen from institutions you trusted years ago can still surface and threaten your family today. Taking concrete steps now limits how far attackers can travel along the identity chains they are building. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.