FTL-Fast Transit Line Listed by nova Ransomware Group

On June 23, 2026, logistics company FTL International N.V. appeared on the leak site of the nova Ransomware Group. The attackers claim to have exfiltrated internal files during a ransomware incident at the shipping and freight-forwarding firm, which operates from major Northern European ports and maintains an office in Colombo, Sri Lanka.

Reported Details from Reports

Public reporting indicates that nova listed FTL on its dark-web leak portal, accessible via the onion address novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/ftl-fast-transit-line. The company, which provides port-to-port and door-to-door shipping, consolidation, and air-freight services, has not yet published an official statement confirming the breach or detailing the volume of data taken. Available reporting describes the exposed material as internal files but does not specify exact record counts or the precise data types involved. The listing date of June 23, 2026 marks the moment the group chose to publicize the incident after FTL apparently did not meet the attackers’ demands.

Why This Matters for You and Your Family

When a logistics provider like FTL suffers a breach, the information stolen can easily include customer records, shipment details, contact information, and payment data tied to ordinary people and small businesses moving household goods or personal belongings overseas. If your name, address, phone number, or email appears in those files, the exposure creates a permanent risk. Criminals routinely sell or publish such data, allowing identity thieves to open accounts, file fraudulent tax returns, or target you with convincing phishing attacks. For families, a single breach can cascade: one parent’s leaked shipping record might link to a child’s school forms or travel documents stored in the same customer folder.

The Doxxing and Identity-Chain Risk

Stolen logistics files frequently contain enough personal handles, phone numbers, and addresses to begin an identity chain. Attackers cross-reference the data with information from earlier breaches, linking an old email used for a shipment to gaming accounts, social-media profiles, or family photos. This chain turns a simple customer record into a roadmap for doxxing. Public reporting shows that once initial data surfaces on leak sites, follow-on extortion or identity theft attempts often follow within weeks. Credential leaks like this one cascade into account takeovers that can reach your family’s gaming profiles or children’s online identities that share the same household details.

Nova Ransomware Group’s Track Record

Public reporting attributes the attack to the nova Ransomware Group, which emerged in late 2024. The group has claimed responsibility for incidents at manufacturing, healthcare, and transportation firms across Europe and Asia. Its typical playbook begins with initial access through phishing or exploited remote-desktop services, followed by rapid exfiltration of internal documents before encryption. Nova then demands payment and, if unmet, publishes samples on its leak site with countdown timers. The group’s public statements emphasize “double extortion” — threatening both data encryption and public release — a pattern seen in its prior listed victims.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, shipping records, and real-world identity so you can break the chain before criminals exploit it.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s data is caught in hours rather than months.
• Rotate any password you have reused with FTL or similar logistics providers, then switch to 2FA using an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests for any exposed personal records across data brokers and leak sites on your behalf.

The FTL breach is a reminder that even companies you trust with everyday logistics can become gateways to identity theft. Taking concrete steps now limits how far attackers can travel down the chain that begins with one leaked shipping file. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this incident and future ones can create for you and your family.