[NOVA] – Ransomware Victim: The Laxmi Niwas Palace

image

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the NOVA Onion Dark Web Tor Blog page.

Ransomware group:
NOVA
Victim name:
THE LAXMI NIWAS PALACE

AI Generated Summary of the Ransomware Leak Page

On October 23, 2025, The Laxmi Niwas Palace, a luxury historic hotel housed in a former royal palace in Bikaner, India, is identified on a ransomware leak page as a victim. The property, built in 1902 for Maharaja Ganga Singh and now a renowned heritage hotel in the hospitality and tourism sector, is described as a target of a data breach. The leak post asserts that the attackers have exfiltrated data from the hotel’s network and that the networks have been encrypted, signaling a data-leak and encryption scenario. The post references a substantial data volume—approximately 350 GB of documents exfiltrated—and notes a deadline and a call to negotiate, consistent with the double-extortion pattern seen in many ransomware campaigns. The leak page also hosts a gallery of 35 images, described in general terms as internal visuals or screenshots rather than their exact contents, suggesting the leakage includes documentary material or internal visuals associated with the victim. The post date aligns with Oct 23, 2025; there is no separately disclosed compromise date beyond the post date.

From a sanitization and translation perspective, non-English content on the page appears in multiple languages, with the translated text reflecting boilerplate ransomware language that mentions encryption, data exfiltration, deadlines, and negotiation, as well as prompts to contact the attackers. The excerpt also shows a broader, multi-victim context typical of leak sites, including references to a claim page and an extensive image gallery, but no explicit ransom amount is stated for this particular victim within the excerpt. The page’s structure and multilingual content indicate a standard ransomware-leak presentation, where attackers claim to have obtained sensitive data and threaten public release or further disclosure unless negotiations succeed. For risk assessment, the key takeaway is a data-leak/ encryption scenario affecting a hospitality property, with a sizable gallery of visuals and a post date of October 23, 2025, suggesting a credible incident timeline.

Support Our Work

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

AI APIs OSINT driven New features