RANSOMWARE VICTIMCONSTRUCTION

Hoy Construction

hoyconstruction.com
nova📍 United States (US)📅 May 22, 2026
8
same group

Attack Intelligence

Hoy Construction was compromised in a ransomware attack attributed to nova in May 2026. The organization, operating in the Construction sector in United States, was added to the group's data leak site as part of an extortion campaign.

nova operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Since 1933, Hoy Construction has specialized in commercial construction management for commercial, industrial, and institutional facilities in Hampton Roads, VA. As a 100% employee-owned company, they emphasize a design-build approach, preconstruction services, and open-book transparency. Their experienced team collaborates with owners and architects to effectively manage costs and schedules while delivering high-quality, durable buildings. Hoy Construction is dedicated to building strong partnerships and ensuring accountability and communication throughout the construction process - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.

Other Victims — nova (8)

Quick Facts

CountryUnited States (US)
SectorConstruction
Attack DateMay 22, 2026
Domainhoyconstruction.com
Intel Sourceransomlook

Threat Group

nova
Motivation: financial
View group profile →

External Links

Data sourced from Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Victim listing does not imply confirmed breach — intelligence based on group claims.