Inc Ransom claims data breach against galileo.it

• Ransomware group: Inc Ransom
• Country: Italy
• Sector: Financial Services
• Announcement date: November 12, 2025

Inc Ransom claims data breach against galileo.it

The ransomware group known as Inc Ransom has published a notice on its leak site claiming to have targeted the financial technology platform galileo.it. According to the group's announcement, they have successfully gained access to the organization's systems and are now threatening to release stolen information.

Details of the alleged attack

The announcement regarding the breach was published on the group's leak site on November 12, 2025. While the group's post was made in November, the group claims to have gained access to the organization's systems as early as September 12, 2025. This discrepancy between the claimed attack date and the announcement date is a common occurrence in ransomware operations, where attackers may spend months navigating a network before deciding to make a public threat.

The incident is categorized as a data leak. In such scenarios, ransomware groups typically employ a tactic known as double extortion. This method involves not only encrypting an organization's files to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to publish the stolen information on a public leak site, the attackers aim to exert maximum pressure on the victim to pay a ransom to prevent the disclosure of their private data.

Data involved in the claim

The Inc Ransom group has provided specific details regarding the volume of the data they claim to have stolen from galileo.it. According to the screenshots provided on the leak site, the total amount of data is reported to be 449 GB. This data is not presented as a single monolithic file but is instead split into two separate segments: one measuring 286 GB and another measuring 163 GB.

Regarding the specific nature of the files, the listing does not provide a detailed list of specific data types. However, based on the nature of the targeted organization, it is assessed that the content may include financial platform data.

• Total claimed data size: 449 GB
• Segment one: 286 GB
• Segment two: 163 GB

Implications and risks

This incident carries significant risks for galileo.it, particularly due to the sensitive nature of the information potentially contained within the leaked data. Given that the organization operates within the financial technology sector, there is a high possibility that the leaked data could contain customer financial information or corporate operational data. Such a breach can lead to severe consequences for both the company and its clients.

Because galileo.it is based in Italy, the incident may have significant implications for legal sanctions and compliance processes under the General Data Protection Regulation (GDPR). Regulatory bodies often impose heavy fines on organizations that fail to protect sensitive personal and financial data. Furthermore, the leaked data could pose a secondary risk for identity theft or targeted phishing attacks, as malicious actors can use stolen information to impersonate individuals or conduct highly convincing social engineering campaigns.

For organizations operating in the financial services sector, maintaining robust cybersecurity defenses is critical. Common defensive steps to mitigate such risks include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits. However, as seen in this case, the threat of data exfiltration remains a primary concern for modern enterprises facing sophisticated ransomware groups.