Inc Ransom ransomware group lists https://sza.it/ on its leak site

• Ransomware group: Inc Ransom
• Country: Italy
• Sector: Professional Services
• Announcement date: June 30, 2026

Inc Ransom lists SZA Studio Legale on leak site

The threat actor known as Inc Ransom has listed the Italian organization sza.it on its leak platform. According to the announcement made on June 30, 2026, the group claims to have obtained and published various documents that allegedly belong to the organization. This development suggests that the organization's data has been compromised, as asserted by the ransomware group.

Details of the alleged data leak

The announcement made by the threat actor specifies the types of information that are allegedly contained within the leaked files. While the specific volume of data and the exact file count have not been disclosed, the group claims to have published documents that include highly sensitive information. The announcement includes screenshots that display previews of various documents, which the group claims have been exfiltrated from the organization's systems.

The files allegedly released by the group include the following types of data:

• Client data
• Contracts
• Personal data
• Non-disclosure agreements (NDA)

About SZA Studio Legale

SZA Studio Legale is an Italian law firm that specializes in several key areas of legal practice, including corporate law, contracts, and commercial law. The firm provides a range of services to its clients, including legal consultancy and litigation support, primarily serving corporate clients within the region.

Analysis and potential impact

This alleged leak may pose significant secondary risks for the organization's clients and employees, such as the threat of identity theft or the execution of targeted phishing attacks. Because the organization is based in Italy, this incident is likely to be evaluated as a data protection breach under the General Data Protection Regulation (GDPR). The legal implications for such an event often require organizations to notify relevant authorities and inform all affected parties in accordance with their legal obligations.

The use of double extortion tactics by the Inc Ransom group can have a devastating impact on an organization's operational continuity and reputation. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid. This method increases the pressure on the victim by targeting the confidentiality of their data rather than just the availability of their systems.

The Inc Ransom group has been active since mid-2023 and has been observed to employ similar attack patterns in previous incidents. For organizations in the professional services sector, maintaining robust cybersecurity defenses is critical to preventing such breaches. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of phishing and other common entry vectors used by ransomware groups.