KPMG Netherlands Hit by Nova Ransomware Attack On January 23, 2026, KPMG’s Netherlands division fell victim to a ransomware attack by the Nova group, a rising threat actor in the cybercrime landscape. The breach was detected and publicly indexed by ransomware monitoring platforms on the same day, with attackers claiming to have exfiltrated sensitive client data. Nova, known for targeting high-profile corporations in financial and professional services, issued a 10-day ultimatum for ransom negotiations. The group operates via Tor-based command-and-control (C2) infrastructure, utilizing uvicorn-based servers and distributed leak sites across multiple onion domains. Security analysts recommend blocking identified Nova-associated infrastructure and monitoring for lateral movement patterns linked to ransomware deployment. KPMG, a global leader in audit, tax, and advisory services, has not yet publicly confirmed the breach. The firm’s Netherlands operations handle critical financial and compliance data for major enterprises, raising concerns about potential exposure. Stakeholders are advised to await official updates on the incident’s scope and remediation efforts. Nova’s attack on KPMG underscores the persistent threat ransomware groups pose to professional services firms, particularly those managing sensitive corporate and financial information.

Ransomware Group Nova Claims Attack on KPMG Netherlands The ransomware group Nova has publicly named KPMG Netherlands as its latest alleged victim, posting the claim on a dark web leak site. The attack appears to target only the Dutch branch of the global consulting firm, though details about the breach including the type of data compromised and the timeline of the incident remain unclear. Nova has given KPMG a 10-day ultimatum, threatening to publish stolen data if no ransom is paid. As of now, KPMG has not confirmed or denied the claim, nor has it provided updates on the status of its systems. The incident was first detected by the tracker ransomware.live on Friday. Nova has gained notoriety for high-profile attacks, including a 2023 breach of Clinical Diagnostics, which exposed the personal data of over 850,000 individuals, primarily women in a cervical cancer screening program. The group later targeted FysioRoadmap in September, stealing records from more than 20,000 patients. Known for its "double extortion" tactic encrypting systems while also threatening to leak data Nova has successfully pressured victims into paying ransoms, though leaked data often surfaces regardless. The validity of the KPMG claim remains unconfirmed, and the full scope of the potential breach is unknown. If the attack is legitimate and KPMG refuses to pay, Nova has indicated the stolen data will be released online within the 10-day window. Further details may emerge as the situation develops.