Mercatino S.r.l. listed on RansomHub leak site

• Ransomware group: RansomHub
• Country: Italy
• Sector: Professional Services
• Announcement date: April 18, 2024

RansomHub claims data breach against Mercatino S.r.l.

The threat actor known as RansomHub has listed the Italian organization Mercatino S.r.l. on its dedicated leak site. According to the group's announcement, which was posted on April 18, 2024, the attackers claim to have successfully exfiltrated a significant amount of data from the company's infrastructure.

The group's claim involves a substantial volume of information, with the threat actor asserting that they have obtained 1.5 TB of data. This announcement serves as a direct threat to the organization's data security and operational integrity. In the landscape of modern cybercrime, such listings on leak sites are a common tactic used by ransomware groups to pressure victims into paying ransoms, often employing a method known as double extortion where both encryption and data theft are utilized.

Details of the claimed attack

The incident was officially announced on the RansomHub leak site on April 18, 2024. The group claims that the breach occurred on the same day the announcement was made. While the specific methods used to gain access to the network have not been detailed in the leak site post, the scale of the claimed theft suggests a targeted effort to compromise the organization's core digital assets.

The group has provided evidence to support their claims, including screenshots that indicate the presence of specific high-value files within their possession. Based on the information provided by the threat actor, the following data types are allegedly involved in the breach:

• Database virtual hard drives

The inclusion of virtual hard drives belonging to the company's databases is particularly significant, as these files often contain the structured information required for business operations and customer management.

About Mercatino S.r.l.

Mercatino S.r.l. is an Italian retail chain that specializes in the buying and selling of second-hand goods. The company operates by facilitating the trade of various household items, furniture, and personal goods, serving as a marketplace for used items within the Italian market.

Implications and organizational impact

This incident suggests that the organization's database infrastructure may have been compromised. The claimed theft of 1.5 TB of data could potentially have a negative impact on the company's operational continuity and the privacy of its customers. For an organization operating within Italy, such a breach may lead to legal sanctions and mandatory data breach notifications under the General Data Protection Regulation (GDPR).

Given the history of the RansomHub group, there is a risk that the leaked data could be used for secondary attacks or identity theft attempts. RansomHub has been identified as a Ransomware-as-a-Service (RaaS) operation that emerged in early 2024 and reportedly ceased activities in early 2025, suggesting that their attacks were carried out in a highly organized manner.

For organizations operating in the retail and professional services sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include maintaining regular, offline backups of critical databases, implementing strict access controls to prevent unauthorized lateral movement, and ensuring continuous monitoring of network traffic to detect unusual data exfiltration patterns. Furthermore, adhering to regulatory compliance standards helps organizations prepare for the legal and notification requirements that follow a data breach.