Lamashtu ransomware group claims data breach against ClientSolution EFO Service Srl Logitech Srl Safety

• Ransomware group: Lamashtu
• Country: Italy
• Sector: Professional Services
• Announcement date: April 13, 2026

The threat actor known as Lamashtu has listed data allegedly belonging to ClientSolution, EFO Service Srl, Logitech Srl, and SafetyMed Srl on their ransomware leak site. The announcement, made on April 13, 2026, suggests a significant breach involving multiple Italian-based entities. While the group has posted a listing, no ransom demand was specified in the announcement.

The claimed attack and event details

The threat actor known as Lamashtu claims to have successfully exfiltrated operational data from the mentioned entities. According to the group's announcement, the stolen information includes a vast collection of files spanning a significant timeframe, specifically from the year 2000 to 2025. The group alleges possession of approximately 100,000 files.

The details provided by the attacker suggest that the stolen data is not limited to a single department but rather covers a wide array of business operations. The announcement indicates that the leaked information likely includes documents related to general business operations, personnel records, and various legal proceedings. This type of disclosure is a hallmark of modern ransomware operations, where attackers aim to maximize pressure by threatening to release sensitive information.

Ransomware leak sites and double extortion

Ransomware leak sites serve as a platform for cybercriminals to host stolen data to pressure victims into paying ransoms. This tactic is often part of a "double extortion" strategy. In such scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption occurs. If the victim refuses to pay for the decryption key, the attackers threaten to publish the sensitive information on these public leak sites to cause reputational, legal, and operational damage.

The content of the alleged leak

The information claimed to be part of the leak is highly sensitive and covers multiple facets of the affected organizations' operations. The group alleges that the data includes a variety of high-value documents that could be used for malicious purposes. The specific types of data mentioned in the claim include:

• Employee records
• Financial and accounting records
• Legal correspondence
• CAD drawings
• Engineering specifications
• Internal pricing and bid documents
• Identity documents
• Medical certifications
• Banking and payment records

The presence of such diverse data types—ranging from technical engineering specifications to highly personal medical and identity documents—suggests a deep penetration into the organizations' digital environments.

Organization profiles

The affected entities, including ClientSolution, EFO Service, and Logitech Srl, are Italian-based companies. These organizations operate within the professional services sector, specifically providing facility management, business support services, and industrial automation solutions. As a group, they provide essential corporate operational support and technical services to their clients.

Impact and security implications

This breach may pose significant secondary risks for the affected entities and their employees, such as identity theft and corporate espionage. Because the entities are based in Italy, the exposure of this data could lead to intense regulatory scrutiny under the General Data Protection Regulation (GDPR). Furthermore, the disclosure of employee medical and identity documents may create long-term security risks for the individuals whose personal information has been compromised.

While information regarding the Lamashtu group remains limited, the incident highlights the potential for severe impact on operational continuity and commercial reputation. For organizations in the professional services and industrial sectors, such incidents underscore the necessity of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining offline backups, conducting regular security awareness training, and ensuring strict access controls to sensitive technical and personal data to mitigate the risk of exfiltration.