RansomHub ransomware group lists www.gbricambi.it on its leak site

• Ransomware group: RansomHub
• Country: Italy
• Sector: Transportation
• Announcement date: June 18, 2024

RansomHub claims data exfiltration from gbricambi.it

The ransomware group known as RansomHub has officially listed the Italian organization gbricambi.it on its leak site. According to the announcement posted on June 18, 2024, the threat actor claims that data belonging to the organization has been successfully exfiltrated to their own servers.

Details of the alleged attack

The claims made by RansomHub suggest that the servers belonging to gbricambi.it were insufficiently protected, allowing the threat actors to gain access and transfer data to their systems. The group alleges that the attack occurred on June 17, 2024. Following the alleged breach, the group stated that they are currently awaiting negotiations with the organization.

RansomHub has employed a double extortion tactic in this instance. This method involves not only encrypting an organization's data but also stealing sensitive information to use as leverage. The group has threatened that if negotiations are not successful, they will proceed to sell or publish the entire customer base and other sensitive information belonging to the organization. No specific ransom demand has been disclosed by the group, and no information was provided regarding the total size of the stolen data or the specific file count involved in the breach.

Data at risk and potential impact

The announcement provided by the threat actor includes specific samples intended to prove the validity of the breach. These samples include images of Italian identity cards, which strongly suggests that personal data within the organization may be at risk. Based on the provided information, the following types of data are identified as being affected:

• Identity documents

The exposure of such sensitive information can lead to significant secondary risks for the individuals involved, including the potential for identity theft and the execution of targeted phishing attacks. Such attacks often leverage stolen personal details to gain further trust from victims.

Analysis and organizational implications

This incident may pose significant risks regarding the organization's data protection obligations under the General Data Protection Regulation (GDPR). When sensitive personal identifiers like identity cards are compromised, organizations often face the necessity of reviewing their data security processes and notifying the relevant data protection authorities to remain compliant with legal frameworks.

RansomHub is recognized as a Ransomware-as-a-Service (RaaS) entity that emerged in early 2024. It was reported that the group absorbed various affiliates following the ALPHV incident. While the group was active during this period, it has been reported that the group ceased operations in early 2025.

For organizations operating within the transportation sector, such incidents highlight the importance of robust defensive measures. To mitigate the risks of such attacks, organizations typically focus on strengthening server protections, implementing strict access controls, and maintaining comprehensive monitoring to detect unauthorized data transfers. Ensuring that data encryption and regular security audits are in place is a standard defensive step to protect against the exfiltration of sensitive customer and employee information.