Nordfjord Hotell Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or professional information was handled by Nordfjord Hotell now face the possibility that internal records have been copied and could be published or misused. The scale of exposure remains unknown, which leaves those connected to the hotel without a clear picture of what, if anything, has left the organisation’s systems. Nordfjord Hotell was listed on May 19, 2026, by the ransomware group nova. The listing states that internal files were taken during a ransomware operation. No figure has been released for the number of people affected, and the hotel has not confirmed the incident or the volume of data involved.

What happened

The only public record of the event is the listing itself. Nova states that files were exfiltrated and offers to supply a directory listing and samples if the company contacts its support channel. No independent confirmation of the theft or of any subsequent publication of the material has been reported. Timing of the intrusion, the method of access, and the total quantity of data are not disclosed in the available information.

The group behind it: nova

Nova is a ransomware operator that maintains a public listing of claimed victims. The group’s standard practice is to post the names of organisations on a leak site and to indicate that data has been removed from the target’s network. When contacted, the operators have been known to provide directory structures and limited samples of the material they assert was taken. The listing of Nordfjord Hotell follows this pattern, but the claim has not been verified by the hotel or by any third-party investigation made public so far.

About Nordfjord Hotell

Nordfjord Hotell operates in Nordfjordeid, the administrative centre of Stad Municipality in western Norway. It provides accommodation, conference facilities, and leisure services to both business and leisure travellers. Organisations of this type routinely process reservations, payment details, identification documents, and internal administrative records. A successful extraction of such records can affect guests, employees, and business partners whose information is stored in the hotel’s systems.

The information in question

The listing refers only to “internal files.” No inventory of specific data categories has been released. While hotels commonly retain guest names, contact details, booking histories, and payment card information, the precise contents of the exfiltrated material remain unconfirmed beyond the general description of internal files.

What's at stake

Individuals named in the files could see their contact information or travel records appear in future disclosures. Organisations that have used the hotel’s conference or corporate services may find internal correspondence or contract details exposed. The hotel itself faces potential regulatory scrutiny under Norwegian data-protection rules and the practical cost of investigating and containing the incident. Because the number of records and their sensitivity are still unknown, the full extent of these consequences cannot yet be measured.

If your data was in this claimed breach

Begin by monitoring bank and credit-card statements for unusual activity and by enabling multi-factor authentication on any accounts linked to the hotel. Request a copy of your personal data from the hotel under applicable privacy law if you believe your information was held there. Readers can also submit their email address to a free public breach-exposure scanner to check whether the address has appeared in previously published data sets; this provides one limited indicator but does not confirm involvement in the present incident.

AICompiled with AI assistance from public sources and published under our editorial standards.