Nova Biomedical data breach: July 2025 malware attack disrupted operations, letters in January 2026

Date	Event	Record
July 22, 2025	Cyberattack disrupts operations; malware deployed	Nova's letter; Indiana report
January 27, 2026	Letters dated; reports to Massachusetts (5,407) and Indiana (10,764 in all); copy filed in Vermont	Massachusetts, Indiana, Vermont
April 30, 2026	Last day to enroll in the Experian monitoring	Nova's letter and website notice

What happened at Nova Biomedical?

The letter says Nova launched an investigation with outside cybersecurity experts as soon as the attack hit, and found that an unauthorized actor had accessed its electronic infrastructure and deployed malware. It also says Nova coordinated with law enforcement. The investigation then reviewed the data on the affected systems to find whose personal information was involved.

The letter does not use the word ransomware, does not name an attacker and does not say whether data was copied out or only reached. It does not say how long operations were disrupted.

Whose information was involved?

Nova's own notice on its website says it takes the privacy and security of its business partners' and team members' data seriously; it does not mention patients or customers. The letter filed in Vermont leaves the list of information as a blank field, so each person's own letter is the record of what was involved for them.

The Massachusetts record marks every category it tracks for this report:

Record	People	Data marked
Massachusetts OCABR, report 2026-121	5,407 residents	SSN, medical records, financial account, driver's license, credit or debit card
Indiana Attorney General	10,764 in total, 19 in Indiana	not broken out

The documents do not say which medical records were involved, or whose.

What did Nova offer, and is it still open?

Two years of Experian IdentityWorks at no cost, with an enrollment deadline of April 30, 2026, which has passed. Identity restoration does not need enrollment: the website notice says it is available for 24 months from the date of the notice, which runs to January 2028. Nova's notice gives Experian's line as (833) 918-0981, 9 a.m. to 9 p.m. Eastern Time, Monday to Friday, with engagement number B157448.

The notice also sets out Massachusetts rights: a resident can get any police report filed about the attack, and a security freeze costs nothing. The credit monitoring guide compares this offer with others.

Why did the letters take six months?

From the July 22, 2025 attack to the January 27, 2026 letters is 189 days. The letter puts the gap down to the review of the affected data and does not give an end date for it. The notice delay guide shows how long other organizations took, and the operational shutdowns guide covers other attacks that stopped a company's work.

What the documents leave open

• What kind of malware was deployed, and whether data was taken out of Nova's systems.
• How long operations were disrupted.
• Which information belonged to employees and which to business partners.