LTI Services Hit by Nova Ransomware: Ransomware Claim — What’s Alleged & What To Do

LTI Services and its associated towing operation Larick Towing were listed on May 30, 2026, as victims on a public ransomware tracking site. The listing states that corporate data was obtained through a ransomware operation that employs both encryption and threats to release stolen information. The number of individuals whose records may be involved remains unknown, and no further details on the scope or contents of any data have been released by the company. The incident is therefore limited, at present, to a third-party claim of compromise rather than a confirmed public disclosure of records or a quantified breach notification.

Inside the incident

The listing appeared on ransomware.live on May 30, 2026, and attributes the event to the Nova ransomware group, previously known as RALord. The entry identifies LTI Services and Larick Towing as the affected entities and refers only to corporate data. No date of initial access, volume of data, or method of intrusion has been published. The company has not issued a statement confirming or disputing the claim.

How a breach like this happens

Ransomware operations that rely on double-extortion typically begin with an initial foothold, often gained through compromised remote-access services, stolen credentials, or unpatched systems. Once inside the network, operators move laterally, locate data repositories, and deploy encryption tools while copying selected files. The threat to publish the copied material is then used to pressure the victim into payment. Public listings on tracking sites serve as one method these groups use to signal that data has been taken, regardless of whether payment occurs.

LTI Services and its sector

LTI Services operates in the vehicle-towing and roadside-assistance sector through its association with Larick Towing. Companies in this field routinely maintain records related to service calls, customer accounts, vehicle details, insurance information, and internal business operations. A compromise at such an organisation can therefore touch both commercial records and information belonging to individuals who have used towing or recovery services.

The information in question

The only data category named in the listing is corporate data. The precise types of records involved, such as customer files, financial documents, employee information, or operational logs, have not been disclosed. Organisations of this kind commonly hold contact details, service histories, and billing records, but the exact contents of any material obtained remain unconfirmed.

The real-world impact

Individuals whose information appears in corporate datasets held by service companies may face risks of targeted phishing, account misuse, or identity-related fraud if the material is later circulated. For the organisation, the incident can produce operational disruption from encryption, legal and regulatory obligations, and reputational effects. Because the number of affected people and the sensitivity of the data are still unknown, the full extent of these consequences cannot yet be assessed.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with major credit bureaus. Change passwords for any accounts that may share credentials with services linked to LTI Services or Larick Towing, and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.