Promosfera S.r.l. data allegedly leaked by blacknevas ransomware group

• Ransomware group: blacknevas
• Country: Italy
• Sector: Professional Services
• Announcement date: April 30, 2026

The ransomware group known as blacknevas has published a listing on its leak site claiming to have stolen data belonging to the Italian organization PROMOSFERA S.r.l. The threat actor has announced the breach, asserting that they have gained unauthorized access to the company's internal documents and various databases.

The alleged data breach incident

According to the claims made by the blacknevas ransomware group, the threat actor successfully infiltrated the internal systems of PROMOSFERA S.r.l. The group has listed the stolen information on their dedicated leak portal, inviting interested parties to contact them regarding the acquisition of this data. While the group has made these claims publicly, information regarding the specific identity and background of this threat actor remains limited.

This incident follows a pattern often seen in modern cyberattacks known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's data to demand a ransom for decryption; they also exfiltrate sensitive information to use as leverage. By threatening to release the data on a public leak site, the attackers aim to pressure the victim into paying the ransom to prevent the exposure of confidential information, which can lead to significant reputational and regulatory consequences.

The scope of the compromised data

The data allegedly exfiltrated by the blacknevas group is extensive and includes a variety of sensitive information types. The threat actor claims to have accessed databases containing hundreds of thousands of records, specifically targeting promotional participants. The contents of the alleged leak include:

• Passport data
• Employee documents
• Client documents
• Email addresses
• Full names
• Phone numbers
• Internal company documentation

The claim suggests that the breach includes tens of thousands of records containing emails, full names, and phone numbers, alongside much larger datasets containing hundreds of thousands of emails and full names from promotional participants. The inclusion of internal company documentation further indicates a potential compromise of proprietary business information.

About Promosfera S.r.l.

Promosfera S.r.l. is an Italian marketing agency that specializes in the management of promotional campaigns, loyalty programs, and prize competitions for various companies. The organization provides a range of services including operational management, digital marketing solutions, and ensuring legal compliance for the campaigns they manage.

Potential risks and organizational implications

The nature of the data allegedly compromised in this incident poses significant risks to both the organization and the individuals involved. For the employees and clients of PROMOSFERA S.r.l., the exposure of passports, names, and contact details creates a high risk of identity theft and targeted phishing attacks. Such attacks often use stolen personal information to build trust with the victim, making fraudulent communications much harder to detect.

Furthermore, because the company is based in Italy, this incident may trigger specific legal obligations. Under the EU General Data Protection Regulation (GDPR), organizations may be required to notify regulatory authorities and affected individuals of a data breach. Failure to comply with these regulations can result in substantial administrative fines. Additionally, the threat actor's invitation to sell or share the data with third parties increases the risk of secondary data leaks, where the information is redistributed across multiple malicious platforms.

From an operational standpoint, such breaches can lead to significant disruptions and damage to a company's business reputation. To mitigate these risks, organizations in the professional services sector often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust encryption for sensitive data at rest and in transit. Continuous monitoring and a well-tested incident response plan are also essential for managing the fallout of such events.