Lubiam listed on sarcoma ransomware leak site

• Ransomware group: sarcoma
• Country: Italy
• Sector: Retail & E-Commerce
• Announcement date: May 4, 2025

Italian retailer Lubiam targeted by sarcoma ransomware group

The Italy-based retail company Lubiam has been listed on a leak site by the ransomware group known as sarcoma. The threat actor group claims to have successfully gained access to the organization's internal systems, marking a potential security incident for the long-standing fashion house.

Details of the alleged breach

According to the announcement made on May 4, 2025, the group known as sarcoma listed Lubiam on its dedicated leak site. The group claims to have successfully infiltrated the organization's network. While the listing confirms the group's intent to publicize the incident, public information regarding the specific identity and operational methods of the sarcoma group remains limited.

Regarding the specifics of the data involved in this incident, the leak record does not provide any details regarding the nature or size of the data allegedly exfiltrated. Furthermore, the group has not provided any screenshots to substantiate their claims. The listing names no specific data types that have been compromised.

About Lubiam

Lubiam is a long-established Italian fashion company founded in 1911 by Luigi Bianchi. The company specializes in luxury menswear and tailoring. As a family-run business, it is widely recognized for its high-quality craftsmanship and its commitment to the 'Made in Italy' vision.

Risk assessment and industry implications

The alleged leak may pose significant risks to the organization's operational processes and customer data. Because the company is based in Italy, any potential data breaches may lead to legal consequences under the EU General Data Protection Regulation (GDPR). Such regulatory frameworks impose strict requirements on how personal information is handled and protected.

The impact of such an incident often extends beyond the organization itself. Employees and customers of the organization may face secondary risks, including identity theft or targeted phishing attacks. In modern cybercrime, threat actors often use these types of public announcements as part of a double extortion strategy. In a double extortion scenario, attackers do not just encrypt data to disrupt operations; they also steal sensitive information to pressure the victim into paying a ransom by threatening to leak the data publicly.

For organizations operating in the retail and e-commerce sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps often involve implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access early. Protecting customer trust is paramount for luxury brands, making the prevention of data exfiltration a critical priority for modern retail enterprises.