Castilla Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations of every size, including smaller firms in consumer-facing sectors, by stealing data and threatening public release to force payment. Listings on criminal leak sites have become a routine pressure tactic in this landscape, often appearing before any independent confirmation of what was taken or how.

On 2 November 2025, the ransomware group known as nova listed Castilla, a Spanish consumer-services company, claiming to have exfiltrated internal files. The number of people affected remains unknown, and public detail on the precise contents is limited. The claim alone is enough to warrant attention for anyone connected to the firm.

What happened

According to available reporting, Castilla was listed by the nova ransomware group on 2 November 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further public information has been released about the date of the intrusion itself, the technical method used, the volume of data taken, or whether systems were encrypted. The number of individuals potentially affected is unknown. The listing on the group's leak site constitutes an unverified claim rather than independently confirmed evidence of the full scope of the incident.

The group behind it: nova

Nova is a ransomware operation that follows the now-common double-extortion model: data is stolen before systems are locked, and victims are threatened with public disclosure if a ransom is not paid. Like other groups in this category, nova maintains a leak site where it posts the names of organisations it claims to have compromised, sometimes releasing sample files to increase pressure. Public records of its activity show a pattern of targeting entities across multiple sectors and geographies, with listings used as both advertising and coercion. In this case, the group claims Castilla as a victim and asserts that internal files were taken; no additional statements from nova specifically about Castilla have been made public beyond the listing itself.

About Castilla

Castilla is a company operating in the consumer-services industry. It is headquartered in Soria, in the Castile and León region of Spain, employs between five and nine people, and reports annual revenue in the range of one to five million. Organisations of this type typically handle customer records, service contracts, billing information, supplier details and internal operational documents. Even a modestly sized firm can hold sensitive personal and commercial data. A breach claim against such an organisation is consequential because the individuals and partners who deal with it may have limited visibility into how their information is protected, and smaller entities often have fewer resources for rapid incident response and notification.

What was likely exposed

The only data type named in connection with the incident is internal files said to have been exfiltrated in a ransomware attack. Exact contents have not been disclosed. Companies in the consumer-services sector commonly store customer contact details, transaction or service histories, employee records, financial and accounting files, and correspondence with suppliers or partners. Whether any of these categories were among the files taken remains unconfirmed. Public reporting does not identify specific documents, databases or individual records.

The real-world impact

For people whose information may have been among the internal files, the practical risks include possible misuse of contact or identity details for phishing, social-engineering attempts or unsolicited contact. Employees or contractors could face similar exposure of personal or payroll-related data. For Castilla itself, the claim can disrupt operations, require forensic investigation and notification efforts, and damage trust with customers and partners even if the full extent of the theft is never independently verified. Because the number of affected individuals is unknown and the precise data types remain unconfirmed, the scale of any real-world harm cannot yet be measured. The mere public listing, however, places the organisation under pressure and leaves those connected to it uncertain about their own exposure.

If your data was in this claimed breach

If you have done business with Castilla or worked with the company, treat the listing as a prompt for basic precautions rather than confirmed proof that your own records were taken. Practical first steps include:

• Monitor bank and credit-card statements for unexpected activity and enable transaction alerts where available.
• Be alert to phishing emails or messages that reference Castilla or claim to relate to a data incident; verify any such contact through official channels you already trust.
• Change passwords on accounts that may have been used in dealings with the company, especially if the same password is reused elsewhere, and enable multi-factor authentication.
• Request a free credit report or equivalent local credit-monitoring service if you are concerned about identity-related misuse.
• Keep records of any suspicious contact so you can report it to the relevant authorities if needed.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this particular incident remains limited; further confirmation would be required before the full picture is clear.

AICompiled with AI assistance from public sources and published under our editorial standards.