Portel Logistic Technologies listed on nova ransomware leak site

• Ransomware group: nova
• Country: Spain
• Sector: Technology
• Announcement date: June 30, 2025

The threat group known as nova has listed the Spanish technology company Portel Logistic Technologies on its leak site. The announcement, which was posted on June 30, 2025, claims that the group has successfully compromised sensitive information belonging to the organization. This incident follows a common pattern in modern cybercrime where threat actors use public-facing leak sites to pressure victims by threatening to release stolen data.

The claimed attack and event details

According to the announcement made by the group, the breach involves data related to the company's financial and operational processes. The threat group alleges that these critical business functions have been compromised by their intrusion. While the group has published a listing for the organization, public information regarding the specific identity, methods, or background of the nova group remains limited in the public domain.

In many modern ransomware campaigns, threat actors employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of releasing this stolen information on a public leak site serves as additional leverage to compel the victim into paying a ransom. While the specific ransom demand and the total volume of data stolen have not been disclosed in the current listing, the threat of exposure remains a significant component of the group's tactics.

Alleged data types involved in the leak

Based on the information provided in the leak site announcement and associated screenshots, the group claims to have access to a wide variety of sensitive files. The data allegedly leaked includes a range of internal documents and technical assets that could impact the company's operations. The specific items mentioned include:

• Government documents
• Financial reports
• Backup data
• Deal databases
• Certificates
• Network logs

The presence of such diverse data types—ranging from high-level government documents to technical network logs—suggests a broad intrusion into the company's digital environment.

About Portel Logistic Technologies

Portel Logistic Technologies is a technology company based in Spain. The organization specializes in providing software solutions and digital platforms tailored for logistics, customs, and port operations. Their core business focus involves the digitalization of foreign trade processes and the management of the logistics chain, making them a key player in the technological infrastructure of trade and maritime operations.

Risk assessment and industry implications

The nature of the data allegedly leaked poses significant risks to the operational continuity and commercial reputation of Portel Logistic Technologies. The exposure of specific technical assets, such as network logs and certificates, is particularly concerning as it could potentially facilitate secondary attacks on the company's IT infrastructure or enable highly targeted phishing attempts against employees and partners.

Furthermore, because the company is based in Spain, the alleged breach may trigger legal sanctions and intense regulatory scrutiny under the General Data Protection Regulation (GDPR). The disclosure of financial processes and deal databases could lead to the exposure of trade secrets, potentially resulting in a loss of competitive advantage in the logistics technology market.

For organizations operating within the technology and logistics sectors, such incidents highlight the necessity of robust defensive measures. To mitigate the risks of data exfiltration and subsequent extortion, companies often implement strategies such as strict network segmentation, comprehensive encryption of data at rest and in transit, and rigorous monitoring of network logs to detect unauthorized movement. Additionally, maintaining offline, immutable backups and implementing multi-factor authentication across all administrative interfaces are standard industry practices to defend against the evolving tactics used by ransomware groups.