Eriell Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 26, 2026, the ransomware group nova listed Eriell on its leak site and stated that internal files had been taken during an attack. The number of people whose information may be involved is not known, and no further details on the volume or contents of the material have been made public. For employees, clients and partners in the oil and gas sector, the listing raises the possibility that operational records and related personal data have left the company’s control.

Breaking down the breach

The only confirmed information is the date the listing appeared and the group’s description of the material as internal files obtained through a ransomware operation. No figure for records or individuals has been released, and the company has not issued a statement confirming or denying the claims. The method of initial access and the timeline of the intrusion remain undisclosed.

Inside nova

Nova is a ransomware operator that maintains a public leak site to pressure victims. The group typically exfiltrates data before encryption and offers samples or directory listings to organisations that contact its support channel. Its listings are presented as claims until independently verified; in this case the site states that Eriell was approached with samples of the material taken.

Who is Eriell?

Eriell Group RU, established in 2014, provides oil and gas engineering services with an emphasis on advanced drilling solutions. Its clients are other energy companies that rely on the firm for operational improvements and specialised drilling technologies. Organisations of this type routinely hold technical specifications, contract details, employee records and communications with clients and regulators.

What was likely exposed

The listing refers only to internal files exfiltrated in a ransomware attack. No inventory of file types or data categories has been published. While companies in this sector commonly store project documentation, personnel files and client correspondence, the precise contents of the material claimed by nova have not been confirmed.

The real-world impact

Individuals whose details appear in internal files could face increased risk of targeted phishing or misuse of professional contact information. The organisation itself may encounter operational disruption if the files contain proprietary drilling methods or client agreements. Until the scope is clarified, both the company and any affected parties must treat the exposure as possible rather than confirmed.

Were you affected?

Because the number of individuals involved has not been disclosed, anyone who has worked with or for Eriell should assume their information could be at risk and take standard protective steps.

• Monitor email and financial accounts for unusual activity.
• Change passwords for any work-related systems and enable multi-factor authentication where available.
• Review privacy settings on professional profiles and limit unnecessary data sharing.
• Run a free exposure scan of your email address against known breach data to check for prior appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.