LTI Services and Larick Towing Listed by nova Ransomware Group

On May 30, 2026, the nova Ransomware Group added both LTI Services and Larick Towing to its public leak site, confirming that internal files had been exfiltrated from the companies’ networks.

Confirmed Facts from Reporting

Public reporting indicates the two firms were listed together on the nova leak site hosted at a Tor address. LTI Services operates ltiservices.com and specializes in customization, collision repair, fabrication, and aftermarket parts for heavy-duty trucks from manufacturers including Peterbilt, Kenworth, Volvo, International, Freightliner, and Western Star. Larick Towing is listed alongside it, though specific operational details for the towing company remain limited in available reporting. The data exposed consists of internal files obtained during a ransomware incident; the exact volume and full list of records have not been publicly detailed. No confirmed victim count for individuals has been released, and it is not yet known whether customer, vendor, or employee personal information was included in the exfiltrated material.

Why This Matters for You and Your Family

When vendors like trucking-parts suppliers suffer breaches, the information they hold often includes names, addresses, phone numbers, email addresses, and payment details belonging to ordinary customers. If you or anyone in your household has ever had a truck repaired, ordered parts, or used a towing service that routed through these companies, your details could now sit in an attacker-controlled archive. Internal files frequently contain spreadsheets that link personal data to vehicle identification numbers, insurance claims, or billing records. Once that material circulates, it can be sold quietly on underground forums long before any public announcement reaches you. For families, this risk extends beyond inconvenience: stolen contact details become the starting point for phishing texts, fake invoices, or impersonation attempts aimed at your bank accounts or children’s school records.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one company’s customer list. Attackers map relationships between emails, phone numbers, usernames, and physical addresses to build larger profiles. A trucking customer’s work email might link to a personal account used for a child’s gaming login; the same street address appears on both. These connections let criminals move from one compromised account to the next. Credential leaks like this one cascade into account takeovers precisely because people reuse passwords across business vendors, email, and entertainment platforms. Gaming accounts belonging to children are especially vulnerable because they often share the family address or a parent’s payment method, turning a single vendor breach into a doxxing chain that can expose location history, chat logs, and photos.

Nova Ransomware Group’s Track Record

Public reporting attributes the nova Ransomware Group with emerging in late 2024. The group has listed dozens of organizations ranging from small manufacturers to service firms. Its typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by exfiltration of internal documents before encryption. The group then posts samples on its leak site and demands payment to prevent full publication. Extortion style focuses on short deadlines and the threat of releasing sensitive operational files that can damage business relationships or expose customer data. Exact prior victim counts fluctuate in open sources, but the group maintains a steady cadence of new listings each month.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this leak may have exposed.
• Rotate any password you ever used at LTI Services or Larick Towing and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next time your information appears it is caught within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts sharing the same address or payment details.
• Let remediation specialists handle takedown requests for any personal records that surface on data broker sites or underground marketplaces.

The incident shows that even specialized vendors can become gateways to personal exposure for thousands of ordinary customers and their families. Taking concrete steps now limits how far attackers can travel along the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly includes children’s gaming accounts vulnerable to credential-stuffing attacks. Start your DoxxScan trial today to close the gaps this breach has opened.