SIT Group (Italy) Claimed by MedusaLocker Ransomware
On May 5, 2026, the MedusaLocker ransomware group claimed responsibility for a cyberattack against SIT Group, a key player in Italy's industrial sector. The threat actors have issued a warning of impending data leaks unless their ransom demands are satisfied. The incident report also mentions 'Bulgarian Robusta (robusta.bg)' and 'abv.bg emails' in the threat actor statement, suggesting a broader scope or related entities.
Signal context
First seen: May 5, 2026
Last updated: Jul 3, 2026
Status: Public signal
Key points
- MedusaLocker ransomware group claimed responsibility on May 5, 2026.
- Targeted SIT Group, an Italian industrial company.
- Threat actors warned of impending data leaks if ransom demands are not met.
Signal analysis
BetaThis analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Sector: Manufacturing
Likely country: 🇮🇹 Italy
inferred from company domain
Watch ransomware, endpoint compromise and business interruption exposure.
- Source type: outside the affected organization
Impact area: Availability
- 2 signals in the same sector
- 27 signals with the same likely impact area
- 1 signal linked to this organization/domain
External sources
Related signals
Grouped by why the signal is relevant.
Challenge Manufacturing Data Breach Exposes Social Security Numbers
Challenge Manufacturing, an automotive manufacturing company, disclosed a data breach to the Texas Attorney General on June 26, 2026. The Chaos ransomware group claimed responsibility on May 17, 2026, stating they obtained 270 GB of data from the company's systems.
Como Furniture Enterprises Data Breach by LockBit
Como Furniture Enterprises, a mold design and manufacturing company based in Taiwan, was reported to have suffered a data breach discovered on June 19, 2026, with the LockBit ransomware group identified as the threat actor. The group has threatened to leak sensitive data unless their demands are met.
FortiBleed gekoppeld aan ransomwaregroepen INC en Lynx
The 'FortiBleed' cyber campaign, which previously exposed login credentials for thousands of Fortinet firewalls, has now been linked to the ransomware groups INC and Lynx. Forensic investigations revealed evidence on a Windows server used in the attack infrastructure, showing administrators had access to negotiation portals of both ransomware groups. This suggests a strong connection between the credential theft and subsequent extortion campaigns. Researchers estimate that over 430,000 FortiGate firewalls worldwide were targeted, with sniffers installed on approximately 19,000 systems to intercept network traffic.
eogb.co.uk Hit by Stormous Ransomware Group
eogb.co.uk, a UK-based organization, was claimed as a victim by the Stormous ransomware group. The incident was discovered on June 28, 2026, at 21:29 UTC, with deep access to Microsoft Dynamics GP, internal legal documents, partnership agreements, customer contracts, operational spreadsheets, financial reports, and executive documents.
Latvijas Valsts Mezi (LVM) Suffers Cybersecurity Breach
Latvia's state-owned company Latvijas Valsts Mezi (LVM) confirmed a cybersecurity breach of its IT systems, reported on June 26, 2026. The incident, discovered around June 22, led to hackers accessing LVM's IT infrastructure. External IT systems, including 'LVM GEO' and the 'Mednis' hunting app, were taken offline, along with some internal communication systems. A foreign ransomware group claimed responsibility for the attack, which raised concerns due to LVM's role in developing an electoral IT platform for Latvia's parliamentary elections.
Alamo Heights ISD Reports Data Breach Following Ransomware Attack
Alamo Heights Independent School District (ISD) reported a data breach impacting over 26,000 people, disclosed to the Texas Attorney General's office on June 25, 2026 (published June 26, 2026 UTC). The breach was linked to a ransomware attack by the Qilin group, which occurred on April 9, 2026. The compromised information included names, Social Security numbers, driver's license numbers, and bank and medical information.