HostingFest Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations continue to target providers that underpin online services, where a single compromise can affect many downstream users even when the total number of individuals involved remains unknown. On November 20, 2025, the group nova listed HostingFest on its leak site, claiming to have carried out a ransomware attack that resulted in the exfiltration of internal files. The organisation’s primary domain became inaccessible due to encryption, and no confirmed count of affected people or further details on the data have been made public.

What happened

The incident was reported on November 20, 2025, when nova added HostingFest to its data-leak listing. The group claims responsibility for a ransomware attack in which internal files were taken. HostingFest has not issued a public statement confirming the breach or providing additional technical details. The scale of the intrusion, the method of initial access, and the volume of data involved are not disclosed in available reporting.

Inside nova

Nova is a ransomware group that maintains a public leak site to pressure victims into paying ransoms. Like other actors in this category, it typically gains access through common vectors such as compromised credentials or unpatched systems, then deploys encryption while copying files for later disclosure. The group’s listings are presented as claims; independent verification of each incident is not always available at the time of publication.

Who is HostingFest?

HostingFest supplies domain registration, web hosting, virtual and dedicated servers, e-commerce infrastructure, and SEO services to individual and corporate customers. Organisations of this type routinely manage customer account information, server configurations, billing records, and administrative credentials. A disruption at such a provider can affect the availability and security of websites and online services belonging to its clients.

What was likely exposed

The only information released states that internal files were exfiltrated. No specific categories of data, such as customer names, payment details, or server logs, have been confirmed. Hosting providers commonly store authentication data, configuration files, and contact records, yet the precise contents of the exfiltrated material remain unconfirmed.

What's at stake

Individuals and businesses that rely on HostingFest services face potential follow-on risks if account credentials or configuration details were among the files taken. For the organisation, the incident adds operational strain from recovery efforts and possible loss of client trust. Because the number of people affected is unknown, the full scope of downstream consequences cannot yet be assessed.

If your data was in this claimed breach

Monitor accounts associated with HostingFest services for unusual activity and change passwords where possible. Enable or verify multi-factor authentication on any linked systems. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.