ASCOM S.p.A. and IT provider Emilcom S.r.l. targeted by blacknevas ransomware group

• Ransomware group: blacknevas
• Country: Italy
• Sector: Manufacturing
• Announcement date: August 14, 2026

The blacknevas ransomware group has listed the Italian manufacturing company ASCOM S.p.A. and its IT service provider, Emilcom S.r.l., on its dedicated leak site. The announcement, made on August 14, 2026, claims that the threat actor has successfully compromised data belonging to both the organization and its service provider. While the group has published a listing, the specific details regarding the total volume of stolen data and the exact ransom demand remain unknown.

The details of the alleged breach

According to the claims made by the blacknevas group, the threat actor has gained unauthorized access to sensitive information. The listing on the leak site includes specific details regarding the operations of ASCOM S.p.A. and its relationship with its IT service provider, Emilcom S.r.l. The threat actor asserts that the data associated with these entities has been compromised, potentially exposing internal business processes and sensitive documentation.

The breach appears to have occurred around August 7, 2026, according to the claims made by the group. In many modern ransomware campaigns, threat actors utilize a method known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this stolen information on a public platform is then used as leverage to pressure the organization into paying a ransom. If the victim refuses to comply, the attackers threaten to release the data to the public, causing significant reputational and legal damage.

Data types identified in the leak

Based on the information provided in the leak site announcement, the compromised data includes a variety of sensitive materials. The evidence presented via screenshots indicates that the breach involves both personal and corporate information. The specific types of data identified as being affected include:

• Identity documents
• Technical drawings
• Corporate forms

The presence of technical drawings suggests that intellectual property may be at risk, while the presence of identity documents indicates a significant risk to personal privacy for individuals associated with the companies.

Organizational profile of ASCOM S.p.A.

ASCOM S.p.A. is an Italian-based company that specializes in the manufacturing of heavy lifting equipment. Their product range includes boat hoists and gantry cranes designed for both the marine and industrial sectors. Since its founding in 1972, the company has established a global presence, providing customized lifting solutions to clients in over 50 countries worldwide.

Risk assessment and industry implications

This incident poses significant risks regarding data privacy due to the exposure of both corporate and personal information. Because ASCOM S.p.A. is based in Italy, this breach may trigger legal processes under the General Data Protection Regulation (GDPR), which governs how personal data must be protected and how breaches must be reported. The exposure of identity documents is particularly concerning, as it could facilitate identity theft or enable highly targeted phishing attacks against employees, clients, and other third parties.

A critical aspect of this incident is the potential involvement of a supply chain attack. The listing includes information regarding Emilcom S.r.l., the IT service provider for ASCOM S.p.A. This suggests that the attackers may have gained access to the manufacturing firm by first compromising its third-party IT services. Supply chain attacks are a growing concern for industrial organizations, as attackers target service providers to gain