Citta Nuova listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Italy
• Sector: Retail & E-Commerce
• Announcement date: July 10, 2023

The Rhysida ransomware group has officially listed the Italian organization Citta Nuova on its leak site. The threat actor group has published a notice claiming that data belonging to the publishing house has been compromised during a recent cyberattack.

The claimed attack and group actions

According to the announcement made on the group's leak platform on July 10, 2023, the Rhysida ransomware group alleges that they have successfully gained unauthorized access to the organization's networks. The group claims that this access allowed them to encrypt the target's data, effectively disrupting operations through encryption.

Ransomware attacks of this nature typically involve a multi-stage process where attackers penetrate a network, escalate privileges, and eventually deploy encryption software to lock files. Once the data is encrypted, the attackers often use a secondary method known as double extortion. In a double extortion scheme, the threat actors do not just lock the victim's files but also steal sensitive information before the encryption occurs. They then threaten to leak this stolen data on public forums or dark web leak sites if the ransom is not paid, creating a dual pressure point for the victim.

Details regarding the leaked data

Despite the public announcement made by the Rhysida group, the listing provides no specific details or screenshots regarding the nature of the leaked data. No information has been provided concerning the volume of files involved or the specific types of data that were allegedly exfiltrated during the breach.

The lack of specific information in the initial announcement is a common occurrence in ransomware incidents, as groups often use the initial listing as a way to signal their success and exert pressure before providing further details or negotiating terms.

About Citta Nuova

Citta Nuova is an Italian publishing house that was founded in Rome in 1959. The organization is involved in the production of books and periodicals, focusing on various cultural, social, and religious topics.

Risk assessment and organizational implications

This incident poses a significant risk of sensitive data being leaked or made public. Because the organization operates within Italy, a confirmed breach could lead to legal sanctions and mandatory notification obligations under the General Data Protection Regulation (GDPR). The potential exposure of personal data belonging to employees or customers could trigger secondary risks, such as identity theft and the execution of targeted phishing attacks against the affected individuals.

Given the double-extortion tactics employed by groups like Rhysida, it is possible that the data may be published or that the organization may face continued pressure for a ransom payment. While public information regarding the specific operations of the Rhysida group remains limited, their methods align with broader industry trends where data privacy is used as a primary lever for extortion.

For organizations operating in the retail and publishing sectors, maintaining robust defensive postures is essential. Common defensive steps include implementing multi-factor authentication (MFA) across all remote access points, maintaining offline and immutable backups to ensure data can be restored without paying a ransom, and conducting regular network segmentation to prevent lateral movement by attackers. Furthermore, continuous monitoring of network traffic and employee training to recognize phishing attempts are vital components of a modern cybersecurity strategy designed to mitigate the impact of such breaches.