Nova Ransomware Group Shifts Target from NSW Government to Rural Fire Service In early June, the Nova ransomware operation claimed to have breached the New South Wales (NSW) government, threatening to leak sensitive data. NSW Chief Cyber Security Officer Marie Patane dismissed the claims, stating the provided sample contained only publicly available and historical information, with no evidence of a network intrusion. However, on 25 June, the NSW Rural Fire Service (RFS) disclosed a separate cybersecurity incident, notifying members of potential exposure of historical data. Acting Commissioner Kelly Quandt confirmed that investigations found no evidence of sensitive personal information being accessed or misused, though technical analysis remains ongoing. Over the weekend, Nova delisted the NSW government from its leak site and replaced it with the NSW RFS, revealing that the datasets primarily contour maps and emergency response project details were identical to those initially attributed to the government breach. About Nova Emerging in early 2025, Nova operates as a ransomware-as-a-service (RaaS) group, splitting profits with affiliates under performance-based tiers (ranging from 75/25 to 95/5 in favor of affiliates). The group provides tools, exploits, and guidance in Russian, Chinese, and English, targeting victims globally. The NSW RFS marks its first confirmed Australian victim, with Nova responsible for 140 leak posts, including 25 in May 2026 alone. About the NSW RFS The NSW Rural Fire Service is the world’s largest volunteer fire service, with 69,000 volunteers across 110 local government areas. In 2024–25, it responded to over 32,000 incidents, including bushfires, motor vehicle accidents, and structural fires. The extent of the exposed data and potential operational impact remains under investigation.