Deadlock ransomware group lists NXIT and Franco Vago S.p.a. and Traconf Srl on its leak site

• Ransomware group: Deadlock
• Country: Italy
• Sector: Professional Services
• Announcement date: July 10, 2026

Deadlock claims to have exfiltrated data from NXIT and affiliates

The ransomware group known as Deadlock has listed several organizations on its leak site, claiming a successful data breach. According to the group's announcement made on July 10, 2026, the targeted entities include NXIT, Franco Vago S.p.a., and Traconf Srl. The group alleges that they have successfully exfiltrated a significant amount of sensitive internal information belonging to these organizations.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. In many modern cyberattacks, groups employ a tactic known as double extortion, where they not only encrypt an organization's systems but also steal sensitive data. The threat of releasing this stolen information publicly serves as additional leverage to compel the victim to meet the attackers' demands.

Details of the alleged attack

The claim made by Deadlock suggests that the attack occurred on July 10, 2026. The group asserts that the volume of data compromised during this incident amounts to 220 GB. This information was posted to the group's dedicated leak site, which serves as a public platform for their extortion attempts.

Despite the claims made by the threat actor, there are limitations to the available information. While the group has listed the victims and the alleged size of the breach, the associated data leak portal currently appears to be empty. Observations of the portal show that it returns an HTTP 403 error, preventing access to any purported files. Furthermore, the group has not provided a specific ransom demand for the return or non-disclosure of the data.

Data involved in the claim

The group claims that the stolen information consists of sensitive internal data. However, the listing does not specify any particular categories of data or provide a file list. The following details represent the current status of the information provided by the attacker:

• The listing names no specific data types or file samples.

In many such incidents, the lack of immediate file samples makes it difficult for investigators to determine the exact nature of the breach until the group decides to release the data or until the victim discovers the intrusion through internal audits.

Organization profile: NXIT

Nippon Express Italia (NXIT) is identified as a primary target in this claim. NXIT serves as the Italian subsidiary of the global NX Group. The company operates within the professional services sector, specializing in integrated logistics and international freight forwarding services. Their operations are notably focused on the fashion and luxury sectors, which often involve complex supply chain requirements and high-value goods management.

Potential impacts and industry risks

The claims made by Deadlock could have significant implications for the targeted organizations. If the allegations are accurate, the breach may create negative impacts on the logistics and supply chain operations of NXIT and its affiliates. The integrity of the supply chain is a critical component of international freight forwarding, and any disruption or exposure of sensitive data can undermine operational continuity.

Furthermore, the potential release of sensitive data may trigger legal processes regarding data protection obligations under the General Data Protection Regulation (GDPR). Depending on the actual content of the data, the organizations may face regulatory scrutiny and legal liabilities. There are also secondary risks to consider, such as the possibility of targeted phishing attacks directed at employees or business partners using the information gathered during the breach.

For organizations operating in the logistics and professional services sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. As the group's information remains limited, the commercial reputation and operational stability of the affected organizations remain at risk due to the data scheduled for release.