CasaSafer listed on Nova ransomware leak site

• Ransomware group: Nova
• Country: Italy
• Sector: Retail & E-Commerce
• Announcement date: May 27, 2026

Nova ransomware group claims attack on CasaSafer

The Nova ransomware group has officially listed the Italian-based vacation rental service CasaSafer on its dedicated leak site. This announcement, made on May 27, 2026, marks a significant escalation in the threat landscape for the organization. Ransomware leak sites are often used by cybercriminal groups as a method of double extortion, where attackers not only encrypt an organization's data but also threaten to publish sensitive information publicly to pressure the victim into paying a ransom.

According to the claims made by the Nova group, they have successfully gained unauthorized access to the internal systems of CasaSafer. The group asserts that the organization's files have been compromised and that contact must be established with the attackers to facilitate the decryption of the affected data. To increase the pressure on the victim, the group has issued a deadline, stating that if contact is not established within 10 days, the decryption key may become unavailable, rendering the recovery process significantly more difficult or impossible.

Details regarding the claimed data breach

At this stage of the incident, there is no detailed information available regarding the specific nature of the leaked or threatened data. The group has not provided specifics concerning the volume of data or the exact types of files that have been targeted. Furthermore, the provided screenshots associated with the leak site indicate that the specific details of the announcement could not be retrieved, leaving much of the scope of the breach unknown.

The listing names no specific data types that have been targeted in this incident.

The organization profile

CasaSafer is a vacation rental business located in Florence, Italy. The company specializes in providing accommodation services, specifically offering four independent apartments designed for both short-term and long-term stays for travelers.

Impact and organizational implications

This incident suggests that customer and operational data within CasaSafer may be at risk. For a business operating within Italy, such an event carries significant legal implications, as the organization may face obligations under the General Data Protection Regulation (GDPR) regarding the protection of personal data. If a data breach has indeed occurred, the individuals whose information was stored by the company could potentially be exposed to various risks, including identity theft or phishing attacks.

Regarding the threat actor, information about the Nova group remains limited, making it difficult to attribute the attack to a specific known entity or to predict their future behavior. However, it is assessed that the organization's operational continuity may have been disrupted due to the ransomware incident, as the group's claim of system access and file encryption typically results in significant downtime for the affected business.

In the retail and e-commerce sectors, such incidents highlight the importance of robust cybersecurity frameworks. Organizations in this sector can take several defensive steps to mitigate the impact of ransomware, such as maintaining offline, immutable backups of critical data, implementing multi-factor authentication across all remote access points, and conducting regular security awareness training for employees to prevent initial access via phishing. Additionally, maintaining a clear incident response plan is vital for managing the legal and operational fallout of a potential data breach.