Trevi S.p.A. Hit by Nova Ransomware: Ransomware Claim — What’s Alleged & What To Do

Trevi S.p.A., an Italian engineering and construction company, was the subject of a claim by the Nova ransomware group that data had been taken from its systems. The claim appeared on listings tracked by Ransomware.live and Breachsense and was reported publicly around 9-10 June 2026. No official statement from the company has been referenced in the available records, and the number of individuals affected remains unknown.

The incident is notable because it involves a firm that works on large-scale infrastructure projects, where any confirmed exposure of internal records could affect clients, partners and employees. At present the scale, method and confirmation of the claimed exfiltration are not publicly detailed.

Breaking down the breach

Public reporting indicates only that a claim was posted attributing the incident to the Nova ransomware group and stating that data had been removed. No figures for records involved, no list of file types and no timeline of access have been released by the company or by investigators. The dates of the claim and its appearance on the two monitoring sites constitute the only confirmed public markers.

How a breach like this happens

Ransomware operations that include claims of data removal commonly begin with an initial foothold gained through remote-access services, phishing or unpatched systems. Once inside, operators may move laterally to locate and copy files before deploying encryption tools. The exfiltration claim itself is made by the group on its listing channels; independent verification of the data’s volume or sensitivity is not available in this case.

Trevi S.p.A and its sector

Trevi S.p.A. operates in the specialised engineering and construction field, delivering foundation and geotechnical works for civil and industrial projects. Companies of this type routinely maintain records on bidding processes, design specifications, supplier contracts and workforce details. A claim of data removal from such an organisation therefore touches both commercial confidentiality and the personal information of staff and contractors.

The information in question

The types of data said to have been taken have not been disclosed. Organisations in engineering and construction typically hold employee records, project documentation, financial files and correspondence with clients and regulators. Without a published inventory or confirmation from Trevi S.p.A., the precise contents remain unconfirmed.

The real-world impact

Individuals whose information appears in company systems could face risks of targeted phishing or identity misuse if the material is later circulated. For the organisation, the claim introduces uncertainty for ongoing projects and contractual relationships until the scope is clarified. No evidence of subsequent misuse has been reported in the available records.

Were you affected?

Anyone who has worked with or for Trevi S.p.A. can begin by monitoring their email accounts for unusual activity and by enabling multi-factor authentication on services that hold personal or financial data. A free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in previously published collections, providing a starting point for further checks.

AICompiled with AI assistance from public sources and published under our editorial standards.