AV Services Barcelona Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

AV Services Barcelona, a provider of audiovisual services for events in Spain, was listed by the ransomware group known as nova on or around September 25, 2025. Public reporting indicates that the group claims to have conducted a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and independent confirmation of the full scope is limited at this stage.

This listing matters because organisations that handle event production and client coordination often store operational and contact data that, if exposed, can create practical risks for staff, partners and customers. Details beyond the group's claims and the basic fact of the listing have not been widely disclosed.

Inside the incident

According to available reports, AV Services Barcelona appeared on the leak site associated with the nova ransomware group. The group claims it stole 100 GB of data, including resources, as part of a ransomware attack that involved the exfiltration of internal files. The precise date of the intrusion itself, the method of initial access, and whether systems were encrypted or only data was taken have not been publicly detailed. The number of individuals whose information may have been involved is listed as unknown. No further technical indicators or forensic findings have been released in the public record surrounding this listing.

The incident is therefore known primarily through the group's own claim of responsibility and the associated leak-site entry. Organisations in similar situations sometimes negotiate, restore from backups, or engage incident-response teams, but no such steps have been confirmed for this case. Public detail on the timeline after the reported listing date of September 25, 2025, remains limited.

Who is nova?

Nova is a ransomware group that has operated by targeting organisations, encrypting or threatening to release stolen data, and posting victim names on dedicated leak sites to apply pressure. Like many such actors, it typically claims to have exfiltrated files before or instead of encryption and uses the threat of public release to seek payment. Public reporting on the group has documented a pattern of listing mid-sized companies across various sectors, often with claims about the volume of data taken. These tactics are well-established in open-source coverage of ransomware activity.

In this instance the group claims to have stolen 100 GB of data that includes resources from AV Services Barcelona. That assertion originates from the actors themselves and has not been independently verified in the available facts. No additional statements attributed specifically to this victim beyond the listing and the volume claim appear in the public record used here.

Who is AV Services Barcelona?

AV Services Barcelona specialises in comprehensive audiovisual services for events, primarily in Barcelona and Madrid. Public descriptions of the company note more than 15 years of experience and a focus on audiovisual production, hybrid events, streaming, videoconferencing, and equipment rental such as sound systems, LED screens and lighting. It serves corporate clients and emphasises tailored solutions, flexibility and customer service.

Companies of this type typically maintain client contact lists, project files, contracts, technical configurations, staff records and logistical data needed to deliver live and hybrid events. A breach involving internal files can therefore affect both the organisation's operations and the privacy of people whose details appear in those systems. Because the firm works with corporate clients across events, the potential reach of any exposed material extends beyond its own employees to partners and attendees whose information may have been stored for production purposes.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. The group further claims the volume of stolen data is 100 GB and that it includes resources. Exact file names, categories or individual records have not been itemised in the public reporting. Consequently the precise contents remain unconfirmed.

Organisations that provide audiovisual production and event services commonly hold project documentation, client correspondence, booking details, equipment inventories, staff contact information and financial or contractual records. Any of these could fall under the broad description of "internal files" or "resources," yet it is not established which specific items, if any, were among the claimed 100 GB. Readers should treat the data types as unconfirmed beyond the general characterisation given in the reports.

The real-world impact

For individuals whose information may have been present in the exfiltrated files, possible consequences include unwanted contact, phishing attempts that reference genuine event or company details, or misuse of personal identifiers if such data were included. Because the number of people affected is unknown and the exact data types are not itemised, the scale of personal risk cannot be quantified from public sources.

For the organisation itself, exposure of internal files can disrupt ongoing projects, damage client trust, and create operational costs related to investigation, notification and system recovery. Ransomware incidents often require temporary workarounds for production schedules and may affect the ability to deliver services until systems are verified clean. These impacts are typical of similar events and are not unique to this case; they remain contingent on what was actually taken and how the company responds.

Were you affected?

If you have worked with AV Services Barcelona as a client, partner, staff member or event participant, consider monitoring accounts and communications for unusual activity that references the company or specific events. Change passwords on any shared or related systems, enable multi-factor authentication where available, and remain cautious of unsolicited messages that appear to come from the firm or its contacts. Because the number of people affected is unknown and the precise data contents are unconfirmed, there is no public list of individuals to check against.

As a practical next step, you can run a free exposure scan of your email address to see whether it has appeared in known breach data sets. This will not confirm involvement in this specific incident but can indicate whether your address has surfaced elsewhere and help you prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.