Tèrra Aventura Listed by nova Ransomware Group: What Was Exposed & What To Do

People who have used Tèrra Aventura’s app or interacted with the service may be wondering whether their personal details were caught up in a recent ransomware claim. Public reporting on 21 July 2026 stated that the organisation had been listed by the nova ransomware group, which asserted that internal files had been taken. The number of people affected remains unknown, and exact confirmation of what was copied has not been independently verified, so the practical stakes for users rest on caution rather than proven exposure.

For an outdoor treasure-hunt platform that encourages people to explore local heritage on foot, any compromise of internal systems raises ordinary but real questions about account data, contact details and operational records. Until fuller disclosure appears, those who registered or played have limited official information to go on.

What happened

On 21 July 2026 it was reported that Tèrra Aventura had been listed by the nova ransomware group. According to the available summary, the group claimed that internal files were exfiltrated in a ransomware attack. Public detail does not include the precise date of intrusion, the technical method used, the volume of data taken, or any confirmed count of affected individuals. The listing itself is a claim by the group; independent verification of the full scope has not been supplied in the reported facts.

Nova’s own notice, as reflected in the summary, indicated that a directory tree, samples and proofs would be provided only if the company contacted the group’s support channels listed in a recovery file. No further operational timeline or ransom demand figures appear in the public record provided.

Inside nova

Nova is a known ransomware operation that follows a familiar double-extortion pattern: encrypting systems where possible and simultaneously copying data, then threatening to publish or auction the material if payment is not made. Groups of this type typically maintain leak sites on which they name victims, post file trees or sample documents, and set deadlines. They often communicate through dedicated support channels referenced in ransom notes or recovery files, exactly as described in the claim attached to this listing.

Public reporting over time has associated nova with attacks on organisations of varying size across multiple sectors. Their listings are assertions intended to pressure victims; they do not by themselves constitute confirmed forensic findings. In this case the facts state only that Tèrra Aventura appeared on the group’s list and that internal files were said to have been exfiltrated. No additional claims made by nova specifically about this victim beyond that listing and the conditional offer of samples are recorded here.

Tèrra Aventura and its sector

Tèrra Aventura is a free, app-based outdoor treasure hunt operating in France’s Nouvelle-Aquitaine region. Players solve riddles, follow walking routes and locate hidden geocaches while discovering local heritage and nature. Services of this kind sit at the intersection of tourism, outdoor recreation and mobile applications. They typically maintain user accounts, location-related progress data, device or app identifiers, and internal operational material such as route designs, partner contacts and administrative files.

A breach affecting such a platform is consequential because the service deliberately gathers people who are physically present in specific outdoor locations and who may have supplied contact or profile information to participate. Even when the core activity is recreational and free of charge, the supporting digital infrastructure still holds records that can be misused if they leave the organisation’s control. The sector as a whole depends on public trust that participation will not expose users to unnecessary digital risk.

What data was at risk

The reported facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No itemised list of data types—such as names, email addresses, phone numbers, precise geolocation histories, payment details or identity documents—has been disclosed. The number of people affected is explicitly unknown.

Organisations that run app-based outdoor activities commonly hold account credentials or reset tokens, email addresses used for registration, device identifiers, progress or route data, and internal documents covering partnerships, staff or logistics. Whether any of those categories were among the files nova claims to possess remains unconfirmed. Readers should treat specific content as unverified until the organisation or independent investigators publish clearer inventories.

Why it matters

For individuals, the concrete risks centre on the possible misuse of whatever personal or contact information may have been stored. If email addresses or account details were included, phishing and credential-stuffing attempts become more plausible. If location-linked or route data were present, the sensitivity is lower than financial records but still relevant to personal privacy. Because the exact contents and the number of people involved are undisclosed, the prudent assumption is that anyone who created an account or supplied details should remain alert rather than assume they were untouched.

For Tèrra Aventura the consequences include operational disruption, the cost of investigation and recovery, and the need to communicate clearly with a user base that joined for a free cultural and outdoor experience. A ransomware listing can also affect relationships with regional partners and public bodies that support heritage tourism. None of these outcomes require proof of negligence; they follow simply from the fact that internal systems were claimed to have been accessed and files removed.

What to do if you're exposed

If you have used Tèrra Aventura, treat the situation as a prompt for basic hygiene rather than panic. Change the password on any account tied to the same email address, enable multi-factor authentication wherever it is offered, and watch for unexpected messages that reference the service or ask for credentials or payments. Be sceptical of unsolicited contacts claiming to help with “breach recovery.”

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step will not confirm or rule out involvement in this specific incident, but it gives a practical view of whether your address is circulating more widely and helps you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.