Pharmacy Ettores Florio SNC listed on RansomHub leak site

• Ransomware group: RansomHub
• Country: Italy
• Sector: Healthcare
• Announcement date: April 8, 2024

The RansomHub ransomware group has listed the Italian healthcare provider PHARMACY ETTORE FLORIO SNC on its dedicated leak site. According to the announcement made on April 8, 2024, the threat actor group claims to have successfully breached the organization's systems and exfiltrated a significant volume of sensitive information.

Details of the claimed attack

The RansomHub group asserts that they have obtained data directly from the servers belonging to PHARMACY ETTORE FLORIO SNC. The listing specifically highlights that the stolen information is related to the institution's online pharmacy operations. According to the claims made by the attackers, the volume of the compromised data is approximately 200 GB. The group has declared its intention to publish this stolen data on their leak site, a common tactic used in double extortion ransomware schemes.

Double extortion is a strategy where cybercriminals not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release the data publicly, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential records. This method increases the pressure on organizations, as the threat of a data leak can lead to severe regulatory, legal, and reputational consequences.

Data types involved in the breach

The listing provided by the RansomHub group specifies several categories of information that were allegedly copied during the attack. The stolen data is said to include critical business and customer records, specifically targeting the core functions of the pharmacy's digital operations. The following items are mentioned as being part of the exfiltrated data:

• Invoices
• Order records
• Delivery addresses
• Apodesk database records

The inclusion of such specific data types suggests that the attackers targeted information that contains highly sensitive personal and transactional details. While the specific file count was not provided in the announcement, the sheer volume of 200 GB indicates a substantial breach of the organization's digital infrastructure.

About PHARMACY ETTORE FLORIO SNC

PHARMACY ETTORE FLORIO SNC is a pharmacy based in Naples, Italy. The organization serves its customer base through multiple channels, providing pharmaceutical and health products via its physical store location as well as through its online sales channels. This dual-mode operation makes the organization a target for cyberattacks due to the high value of the personal and medical-related data processed through its digital platforms.

Impact and industry implications

The potential exposure of this data carries significant risks for the affected institution and its customers. The breach may lead to the exposure of personal and financial data belonging to the institution's clientele. For customers, this creates a heightened risk of identity theft and makes them targets for highly specific, targeted phishing attacks. When attackers possess delivery addresses and order histories, they can craft much more convincing social engineering campaigns.

From a regulatory perspective, given that the institution operates within Italy, it is likely to face legal sanctions under the General Data Protection Regulation (GDPR) requirements. The loss of sensitive customer data often triggers mandatory reporting requirements and heavy fines from data protection authorities. Furthermore, such incidents can cause lasting damage to an institution's commercial reputation and weaken the overall security of the supply chain.

RansomHub is identified as a Ransomware-as-a-Service (RaaS) structure that emerged in early 2024. It has been reported that the group incorporated former members of the ALPHV group into its operations. Although reports indicate that its operations ceased in early 2025, the impact of its historical breaches continues to affect victims. To defend against such threats, organizations in the healthcare sector typically focus on strengthening their defensive posture through multi-factor authentication, regular security audits, and robust data encryption to mitigate the impact of potential exfiltration.