Center Of Information Technologies In Finance Public Institution Listed by nova Ransomware Group

On July 24, 2026, Romania’s Center of Information Technologies in Finance Public Institution (CTIF) was listed on the leak site of the nova Ransomware Group. The public institution, which develops and operates critical automated information systems for Romania’s public finance, accounting, taxation, customs, and public procurement sectors, is claimed to have had internal files exfiltrated during a ransomware attack. The nova leak site does not publicly quantify the number of affected records or specify exact data types beyond claiming that internal files were taken.

Reported Details from the Listing

The primary disclosure on the nova ransomware leak site states that CTIF suffered a ransomware incident in which attackers successfully exfiltrated internal files. No specific volume of data or detailed inventory of exposed information is provided in the listing. The notification confirms the victim is a Romanian public institution responsible for core government financial technology infrastructure. As of the publication date, the listing remains active on the group’s onion site, indicating the extortion process is ongoing.

Why This Matters for You and Your Family

Even though CTIF primarily serves public authorities, budget institutions, and economic agents, its systems interact with the personal and financial data of ordinary citizens. Tax filings, customs records, procurement documents, and accounting data frequently contain names, addresses, personal identification numbers, bank details, and tax identifiers of individuals and families. When such an organization is breached, the exposure can cascade far beyond government networks. If your tax records, customs declarations, or procurement-related information passed through CTIF-managed systems, your personal details may now sit in an attacker’s archive. The disclosure indicates internal files were taken; the exact scope remains unknown.

Doxxing and Identity-Chain Risks

Ransomware leaks like this one rarely stop at the initial dataset. Once internal files leave the victim’s network, they often circulate in underground markets where threat actors combine them with other breaches to build detailed identity profiles. A single leaked government document can link your full name, national identification number, address, phone number, and email addresses. These fragments become the foundation for doxxing chains that lead to account takeovers, SIM-swapping attempts, and targeted fraud. Credential leaks from related systems can also expose logins used for personal email, banking, or government portals, increasing the chance that one breach becomes many.

Nova Ransomware Group Track Record

Public reporting attributes nova as a relatively new ransomware-as-a-service operation that emerged in late 2024. The group has focused primarily on mid-sized organizations and public-sector entities across Europe and Latin America. Notable prior victims include municipal governments, healthcare providers, and logistics companies. Nova’s typical playbook involves initial access through compromised remote desktop protocol credentials or phishing, followed by rapid lateral movement, data exfiltration, and then dual extortion: demanding payment both to decrypt systems and to prevent publication of stolen files. The group usually sets short deadlines and follows through with partial data leaks when victims do not pay.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, government identifiers, and real-world identity, including no-subscription cleanup of exposed records.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any passwords you have used on Romanian government or financial portals and enable 2FA through an authenticator app instead of SMS.
• Cover your entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address and parental credentials.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise require dozens of manual submissions.

The CTIF breach is a reminder that government technology providers are high-value targets whose compromises directly affect the privacy of ordinary citizens and their families. Staying ahead of these cascading risks requires more than reactive password changes. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers. Acting early limits how far attackers can travel with your data.