transvill Data Breach

transvill, a transportation and logistics organization based in Romania, has been listed as a victim on the Nova ransomware group’s dark web portal, published on June 24, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. While the organization’s domain is transvill.ro, the listing appears on the same date as a separate Nova listing for Transvill SRL in Peru. CTI teams should treat these as distinct listings affecting different entities.

In the 60 days prior to this listing, Nova has claimed approximately 43 other victims, with a targeting pattern observed in the technology, manufacturing, and education sectors, and victims concentrated in Peru, the United States, and Spain. Related logistics/transportation entities recently listed by Nova include Transvill SRL, FTL-Fast Transit Line, and Alexandria. Initial access was investigated using SOCRadar’s stealer-log telemetry. No records were found for transvill.ro. However, a null result does not confirm the absence of a breach, as credentials might have been harvested under personal email aliases, indexed against an alternate domain, or surfaced in feeds outside the dataset. Notably, the related Peruvian domain (transvill.com.pe) showed severe exposure in the same telemetry. CTI teams should continue monitoring and implement proactive credential hygiene checks. For ransomware groups like Nova, infostealer-harvested credentials are a common initial access vector. Operators source logs from underground marketplaces, validate corporate credentials, and use them for unauthorized access before deploying ransomware. The absence of evidence in this specific query does not rule out this scenario.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.