Blacknevas claims data breach at PROMOSFERA S.r.l.

• Ransomware group: blacknevas
• Country: Italy
• Sector: Professional Services
• Announcement date: August 6, 2025

The threat actor known as blacknevas has listed data allegedly belonging to PROMOSFERA S.r.l. on its leak site. The group claims to have gained access to the company's systems and obtained various documents, marking a significant potential data exposure for the Italian professional services firm.

The alleged attack and group claims

According to the announcement made on August 6, 2025, the blacknevas group claims to have successfully infiltrated the systems of PROMOSFERA S.r.l. The threat actor asserts that they have obtained a variety of sensitive documents during the breach. In their public communication, the group has criticized the company for its alleged negligence regarding data security measures.

The group's announcement serves as a platform for their typical extortion tactics, where they invite interested parties to contact them regarding the acquisition of the stolen data. While the specific details regarding the ransom demand and the exact size of the data stolen remain unknown, the group's presence on a leak site is a hallmark of modern ransomware operations. These sites are often used in double extortion schemes, where attackers not only encrypt a victim's data but also threaten to publish it publicly to increase pressure on the organization to pay.

Data types and contents involved in the leak

The information allegedly exfiltrated by blacknevas is extensive and includes highly sensitive personal and corporate information. The group claims that the stolen data includes databases of promotional participants, which reportedly contain hundreds of thousands of entries consisting of full names and email addresses, as well as tens of thousands of entries containing full names, email addresses, and phone numbers.

Furthermore, the leak reportedly includes various types of documentation that could be used for fraudulent purposes. The specific categories of affected data mentioned in the claim include:

• Passport data
• Identity information
• Employee data
• Client data
• Email addresses
• Phone numbers
• Internal company documentation

To support their claims, the threat actors have provided screenshots that appear to show samples of Italian passports, identity cards, and official correspondence related to various promotional processes. This visual evidence is intended to demonstrate the legitimacy of their breach to potential buyers.

About PROMOSFERA S.r.l.

PROMOSFERA S.r.l. is an Italian marketing agency that provides services for promotional contests, loyalty programs, and prize management for companies. The organization specializes in legal compliance, operational management, and prize procurement, making them a central hub for managing sensitive consumer data during promotional campaigns.

Risk assessment and industry implications

This potential leak poses several significant risks. For the individuals whose data has been compromised, there is an increased risk of identity theft and fraud. Because the stolen datasets include promotional participant information, these individuals may face a higher likelihood of being targeted by sophisticated phishing attacks. The presence of identity documents and contact details makes them prime targets for social engineering and other fraudulent activities.

From a regulatory perspective, since the company is based in Italy, this incident could potentially lead to data protection violations and administrative sanctions under the General Data Protection Regulation (GDPR). The exposure of such a large volume of personal information often triggers mandatory reporting requirements to regulatory authorities and the affected data subjects.

Regarding the threat actor, information concerning the blacknevas group remains limited. However, their statements regarding the sale of data and the provision of competitive intelligence suggest that secondary risks may persist for the organization and its partners. For companies operating in the professional services and marketing sectors, such incidents underscore the necessity of robust data security processes. Organizations in this sector may need to re-evaluate their security frameworks, implement stricter access controls, and enhance their monitoring capabilities to mitigate the impact of such breaches and protect the vast amounts of consumer data they manage.