Lockers IT Breached by Nova Ransomware: Ransomware Claim — What’s Alleged & What To Do

On June 22, 2026, the Nova ransomware group listed Lockers IT on its leak site. The Bangladesh-based provider of managed IT services, cybersecurity, and cloud solutions was added without accompanying details on the volume of data taken or the categories of records involved. Public reporting has not confirmed the intrusion or the contents of any exfiltrated material.

Ransomware claims of this kind occur regularly against technology service providers. When the target supplies infrastructure and security services to other organisations, the potential downstream effects extend beyond the initial victim. At present the scale of exposure remains unknown.

Inside the incident

The only confirmed public information is the listing itself. No date of intrusion, method of access, or quantity of files has been disclosed in available reports. Breach-monitoring sites carried the entry, yet initial coverage contained no supporting evidence or data samples. Lockers IT has not issued a statement confirming or denying the claim.

Inside nova

Nova is a ransomware operation that follows the double-extortion model common among current groups: encryption of systems paired with the threat of data release. The group maintains a leak site where it lists organisations it claims to have compromised. Such listings constitute an assertion by the actor rather than an independently verified event. Nova has appeared in public reporting on multiple prior incidents, though specific tactics used against any single victim are rarely published in detail at the time of the initial claim.

Who is Lockers IT?

Lockers IT operates as a managed-service provider offering IT administration, cybersecurity controls, and cloud hosting to client organisations. Companies in this sector routinely hold administrative credentials, network diagrams, client contact information, and logs from the environments they support. A compromise at such a firm can therefore affect not only its own records but also data belonging to its customers.

The information in question

No categories of exposed data have been published. Organisations of this type commonly process authentication material, configuration files, and customer account details, yet the precise contents of any material taken in this case remain unconfirmed. Until verified disclosure occurs, the exact nature of the records cannot be stated as fact.

What's at stake

Service providers hold access pathways that can be reused against downstream clients. If credentials or internal documentation were obtained, those items could be leveraged in further attacks even if the original listing is never substantiated with files. For the organisation itself, the incident adds operational disruption and potential regulatory scrutiny once more information surfaces.

What to do if you're exposed

Individuals and client organisations should monitor official statements from Lockers IT and any subsequent regulatory notices. Practical first steps include changing passwords for any accounts linked to the provider, enabling multi-factor authentication where it is not already active, and reviewing access logs for unusual activity. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.