Trevi S.p.A. Hit by Nova Ransomware

Trevi S.p.A., the Italian engineering and construction company behind trevi.it, has been hit by the Nova ransomware group, which claims to have stolen internal data and is threatening to publish it.

Public reporting from BreachSense and Ransomware.live first surfaced the incident around June 9-10, 2026. The Nova group added Trevi to its leak site and stated that it had successfully exfiltrated files from the company’s systems. At this time, the exact number of people affected remains unknown, and the precise categories of data involved have not been confirmed by either the company or the threat actors. Industry research from sources such as DoxxScan™ continuous monitoring indicates that construction and engineering firms frequently store employee records, client contracts, financial details, and contact information that can be valuable in follow-on attacks.

This breach matters to you and your family because Trevi’s business relationships likely touch ordinary people. If you or anyone in your household has ever worked with the company, submitted employment information, or been listed as a contact on a project, your personal details may now sit in a ransomware data set that criminals can sell or publish. Once that information reaches public forums, it can be combined with other leaks to build a complete picture of your life, your address, your children’s names, and your online accounts.

The doxxing and identity-chain implications are especially serious. Ransomware operators routinely sell or trade stolen data on underground markets where other criminals search for usable credentials. A single email or password pair taken from Trevi can be tested across banking, email, social media, and gaming platforms. When those credentials work, attackers can pivot to linked accounts, reset passwords, or publish personal information that reveals your home address, phone number, and family relationships. Children’s gaming accounts are frequent targets in these chains because young users often reuse simple passwords or email addresses tied to family domains, turning one corporate breach into a pathway for harassment or account takeover at home.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this breach may have exposed.
• Rotate any password you used at Trevi or any related service, replace it with a unique passphrase everywhere it appears, and enable two-factor authentication through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak that touches your information is flagged within hours instead of months.
• Cover the entire household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into doxxing chains.
• Let remediation specialists handle the follow-up work, including sending takedown notices to data brokers and monitoring for reappearance of your information on underground sites.

The Trevi incident is a reminder that corporate breaches now feed directly into personal risk. Taking deliberate steps now limits how far criminals can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers that protection through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.