Servetto Srl listed on lamashtu ransomware leak site

• Ransomware group: lamashtu
• Country: Italy
• Sector: Professional Services
• Announcement date: April 13, 2026

Italian manufacturer Servetto Srl targeted by lamashtu ransomware group

The Italian manufacturing company Servetto Srl has been listed on the leak site of the lamashtu ransomware group. This announcement, made on April 13, 2026, follows a claimed attack that occurred on the same day. Through this listing, the threat actor is utilizing its leak site as a mechanism to exert pressure on the organization.

Details of the alleged data breach

The lamashtu group has announced that it has leaked a dataset that allegedly belongs to Servetto Srl. According to the group's claims, the stolen information consists of approximately 80 GB of data, comprising 59,000 files. The group asserts that the compromised data covers corporate operations spanning from 1995 to 2026.

The content of the alleged leak is extensive, involving various aspects of the company's business operations and documentation. The group claims that the data includes the following types of information:

• Customer data
• Employee records
• Financial data
• Supplier contracts
• Engineering data
• GDPR compliance documents

The group further claims that the dataset contains orders, shipments, invoices, banking records, pricing structures, internal procedures, CAD drawings, engineering specifications, and product documentation.

About Servetto Srl

Servetto Srl is an Italian company specializing in wardrobe accessories. The brand is best known for the 'Servetto', a pull-down wardrobe lift that facilitates access to high cabinet areas.

Potential impact and security implications

This incident may pose significant risks to the organization's operational continuity and commercial reputation. The alleged exposure of GDPR compliance documents and employee records could lead to legal sanctions under the European Union's General Data Protection Regulation (GDPR). Furthermore, the disclosure of trade secrets, such as engineering drawings and supplier contracts, may weaken the company's competitive advantage and result in a loss of trust with third-party business partners.

While public information regarding the lamashtu group remains limited, such leaks may facilitate the use of the compromised data in identity theft or targeted phishing attacks. Ransomware groups often employ a tactic known as double extortion, where they not only encrypt an organization's systems but also steal sensitive data to threaten its public release if a ransom is not paid. This approach increases the pressure on the victim by targeting their reputation and regulatory standing.

For organizations operating in the manufacturing and professional services sectors, maintaining robust cybersecurity posture is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of phishing. Protecting intellectual property, such as CAD drawings and engineering specifications, is particularly critical for companies relying on specialized manufacturing processes to maintain their market position.