NewHotel cloud listed on nova ransomware leak site

• Ransomware group: nova
• Country: Portugal
• Sector: Hospitality
• Announcement date: April 28, 2025

The ransomware group known as nova has listed NewHotel cloud on its leak site, claiming that a significant data breach has occurred. According to the announcement made by the threat actor, approximately 60 GB of data has been compromised and made available through their platform.

The claims made by nova

The incident details provided by the nova group suggest a multi-stage attack timeline. The group announced on April 28, 2025, that they had leaked data belonging to NewHotel cloud. According to the claims made by the threat actor, the organization's systems were successfully encrypted on April 15, 2025. Following the initial encryption of the systems, the group asserts that the stolen data was leaked on April 24, 2025.

While the group has taken responsibility for the breach, public information regarding the specific tactics, techniques, and procedures used by nova remains limited. Ransomware groups often utilize double extortion tactics, where they not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data to use as leverage during negotiations. By threatening to release this data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or sensitive information.

Details regarding the leaked data

The announcement regarding the breach does not provide specific details regarding the exact nature of the leaked files. However, the information provided by the group categorizes the compromised data under the label of 'softwares'.

The listing names no specific data types beyond this categorization.

About NewHotel cloud

NewHotel cloud is a technology company based in Portugal that specializes in providing digital solutions for the hospitality industry. The company offers a variety of cloud-based services, including Property Management Systems (PMS), booking engines, and channel management solutions. Their operational goal is to assist accommodation facilities across the globe in digitizing their various operational processes.

Potential implications and industry risks

The implications of this alleged leak depend heavily on the actual content of the 60 GB of data claimed to be stolen. If the data contains sensitive information belonging to the organization's customers or business partners, those parties may face significant risks. Because NewHotel cloud is based in Portugal, any confirmed data breach could potentially trigger legal sanctions and administrative fines under the GDPR (EU General Data Protection Regulation).

Furthermore, because the organization provides essential software services to the hospitality sector, this incident highlights potential risks to supply chain security. A breach of a software provider can potentially facilitate secondary attacks against the provider's client base. The publication of such data can lead to substantial reputational damage for the organization and exposes its customers to various threats, such as targeted phishing attacks or identity theft.

To defend against such threats, organizations in the technology and hospitality sectors often implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication, and conducting regular security audits. Monitoring for unauthorized data exfiltration and ensuring strict access controls are also critical components of a modern cybersecurity posture designed to mitigate the impact of ransomware and data theft.