Booba Project ransomware group lists COSEF - Consorzio di Sviluppo Economico del Friuli on its leak site

• Ransomware group: Booba Project
• Country: Italy
• Announcement date: September 23, 2026

Booba Project claims to have leaked data from COSEF

The threat actor known as Booba Project has officially listed COSEF - Consorzio di Sviluppo Economico del Friuli on its dedicated leak site. According to the announcement made on September 23, 2026, the group claims to have successfully exfiltrated a significant volume of data from the institution's networks. This development follows a pattern common in modern cyberattacks where threat actors use public platforms to pressure organizations by threatening the release of stolen information.

The incident, which the group claims occurred on the same day as the announcement, highlights the ongoing risks faced by regional economic entities. At this stage, public information regarding the specific methodologies used by the Booba Project is limited, as the group maintains a relatively low profile in the broader cybersecurity landscape. Such groups often utilize double extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data to use as leverage during ransom negotiations.

Details of the claimed data theft

The Booba Project has made specific claims regarding the scale of the breach, asserting that they have obtained 200 GB of data from the networks of COSEF. This volume of data suggests a substantial breach of the organization's digital infrastructure, though the exact nature of the files remains unverified.

Regarding the specific contents of the leak, the following observations can be made:

• The listing names no specific data types or individual files.
• No screenshots or visual evidence of the stolen data have been provided by the threat actor.
• There is no detailed information available concerning the specific content of the allegedly leaked data.

In many ransomware scenarios, the lack of immediate detail from the attacker is a common occurrence, as groups often wait to see if the victim responds to their demands before providing more granular information about the stolen assets. This ambiguity can create significant uncertainty for the targeted organization and its stakeholders.

About COSEF - Consorzio di Sviluppo Economico del Friuli

COSEF is an economic development consortium operating within the Friuli-Venezia Giulia region of Italy. The organization plays a vital role in the regional economy, focusing on the development, management, and infrastructure provision of various industrial zones. Furthermore, COSEF provides essential logistics and facility management support for businesses operating within the region, making it a central hub for local industrial and commercial activities.

Risk assessment and organizational implications

Until the actual content of the allegedly leaked data is clarified, the operational and reputational risks to COSEF remain uncertain. The scale of the claimed theft introduces several layers of potential risk that organizations must prepare for when facing such incidents.

Given the claimed volume of 200 GB, several critical concerns arise:

• Legal and regulatory obligations: If the stolen data includes sensitive information belonging to employees or business partners, the institution may face legal obligations under the General Data Protection Regulation (GDPR).
• Secondary cyber risks: There is a potential for the leaked data to be utilized in secondary attacks, such as identity theft or highly targeted phishing campaigns against the organization or its associates.
• Operational continuity: The uncertainty regarding the data content makes it difficult to assess the full impact on the institution's daily operations.

In general, when organizations face potential data breaches, it is standard practice to review data security processes and evaluate the effectiveness of existing defensive measures. Furthermore, if a breach is confirmed, organizations may be required to notify relevant regulatory bodies to comply with legal frameworks and ensure transparency with the affected parties.