Inc Ransom claims data breach against www.labiennale.org

• Ransomware group: Inc Ransom
• Country: Italy
• Sector: Education
• Announcement date: July 24, 2025

Inc Ransom claims a massive data leak at www.labiennale.org

The ransomware group known as Inc Ransom has published an announcement on its leak site claiming responsibility for a significant data breach targeting www.labiennale.org. According to the group's claims, the breach involves a massive volume of information, with the threat actor asserting that they have exfiltrated over 800 GB of data belonging to the institution. The announcement was made on July 24, 2025, coinciding with the date the group claims the attack occurred.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. In many modern cyberattacks, threat actors employ a tactic known as double extortion. In this scenario, the attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. This allows them to threaten the public release of the stolen data if the ransom is not met, creating a secondary layer of leverage that targets the victim's reputation and legal standing.

Details of the claimed attack and stolen information

The threat actor, Inc Ransom, claims to have successfully gained unauthorized access to the institution's internal systems. According to the group's announcement, the breach has compromised highly sensitive information, specifically targeting the organization's financial records and partnership details. To support their claims, the group has provided screenshots on their leak site, which allegedly show samples of the institution's financial statements and personal identification documents.

The specific types of data mentioned in the leak include a variety of sensitive documents. The information claimed to be stolen includes:

• Financial records
• Sponsorship and partnership information
• Personal identification documents

The samples shared by the attackers further suggest that the stolen content includes financial reports, budget spreadsheets, and various contracts. Additionally, the group claims to have accessed sensitive personal identification documents, such as passports, which poses a significant risk to the privacy of the individuals involved.

About the Venice Biennale

The target of this alleged attack, www.labiennale.org, represents the Venice Biennale. Founded in 1895, the Venice Biennale is considered one of the most prestigious cultural institutions in the world. It serves as a major global hub for the arts, organizing a wide range of exhibitions, performances, and research activities. The institution's scope is broad, covering diverse fields including art, architecture, cinema, dance, theatre, and music.

Potential implications and organizational risks

The exposure of such a vast amount of data carries heavy implications for the institution. Because the leaked information contains personal identification documents, there is a high risk of secondary attacks. This includes the possibility of identity theft and highly targeted phishing attacks directed at the institution's employees and its various partners. When personal data is compromised, attackers often use it to craft convincing messages to deceive individuals into revealing further credentials or funds.

Furthermore, the breach may have significant legal and commercial consequences. As the institution is based in Italy, the exposure of personal data may lead to legal consequences under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the EU must adhere to strict data protection standards, and failures in data security can result in substantial regulatory scrutiny and penalties. Additionally, the leaked financial documents may have long-term negative impacts on the institution's commercial confidentiality.

Given the nature of the Inc Ransom group's tactics, the institution may also face operational disruptions and significant reputational damage. For organizations in the education and cultural sectors, maintaining the trust of partners, sponsors, and the public is essential. To mitigate such risks, organizations typically focus on strengthening their defensive posture through robust access controls, regular security audits, and comprehensive employee training to recognize social engineering attempts. Implementing strong encryption for data at rest and in transit is also a standard defensive measure to protect sensitive information from unauthorized access.