Trevi Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The nova ransomware group listed the Italian company Trevi on its leak site on 9 June 2026, claiming to have carried out a ransomware attack that included the exfiltration of internal files. The number of individuals whose information may be involved remains unknown, and no further details on the volume or contents of the material have been made public. For customers and staff connected to the trevi.it site or the parent entity Trevidea srl, the listing raises the possibility that operational records held by a consumer electronics firm have left the organisation’s control.

Breaking down the breach

The only confirmed public information is the listing itself and the group’s assertion that internal files were taken during a ransomware incident. No date of the alleged intrusion, no count of affected records, and no description of the encryption or exfiltration methods have been disclosed. The organisation has not issued a statement confirming or denying the claims at the time of reporting.

The group behind it: nova

Nova is a ransomware operation that maintains a public leak site where it lists victims and, in some cases, posts samples of data to pressure organisations into paying. The group typically follows a double-extortion pattern: encrypting systems and threatening to publish stolen material. Its listings are presented by the group as evidence of successful access, but independent verification of each claim is not always available at the time of publication.

Trevi and its sector

Trevi operates as the consumer-facing brand of Trevidea srl, an Italian company active in consumer electronics. Such firms routinely maintain records related to product support, customer accounts, supply-chain documentation and internal communications. A successful intrusion at one of these companies can therefore expose both personal customer details and proprietary business information.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No specific categories such as customer names, payment data or employee records have been confirmed. Organisations of this type commonly store contact information, order histories and technical support logs, yet the precise contents of the material claimed by the group remain unverified.

Why it matters

Even without confirmed personal data, the exposure of internal files can create downstream risks including targeted phishing, misuse of business relationships or further attempts to access connected systems. For the company, the incident adds operational disruption and potential regulatory scrutiny under Italian and EU data-protection rules. Individuals linked to the brand have no immediate way to assess their own exposure until more details emerge or the organisation provides notification.

If your data was in this claimed breach

Monitor bank and email accounts for unusual activity and enable multi-factor authentication where available. Treat unsolicited messages that reference Trevi or Trevidea with caution. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

• Change passwords for any Trevi-related accounts and avoid password reuse.
• Review privacy settings on connected services and limit data shared with the brand.
• Watch official communications from the company for any future notifications.

AICompiled with AI assistance from public sources and published under our editorial standards.