Stormous ransomware group lists lorenzoni-store.com on its leak site

• Ransomware group: Stormous
• Country: Italy
• Sector: Retail & E-Commerce
• Announcement date: June 24, 2026

The Stormous ransomware group has officially listed the Italian retailer lorenzoni-store.com on its leak site, claiming that the organization's data has been compromised. According to the announcement made on June 24, 2026, the threat actor alleges that they have successfully accessed sensitive information belonging to the company and its associated domains.

The details of the alleged attack

The threat actor known as Stormous posted the listing for lorenzoni-store.com on June 24, 2026. In the announcement, the group alleges that they have gained access to various types of information, including data belonging to customers and buyers. Furthermore, the group claims that they have accessed proprietary designs and order information. The threat actor has stated that the impact of this incident extends to all domains associated with the parent company, suggesting a broad scope of the alleged compromise across the organization's digital infrastructure.

While the group has made these claims, it is important to note that no screenshots were provided by the attackers to substantiate their allegations. Additionally, no specific information was provided regarding the total size of the data stolen, the exact number of files involved, or any specific ransom demand made by the group.

Data types allegedly compromised

According to the claims made by the Stormous group, the breach involves several categories of sensitive information. The group asserts that the following types of data have been accessed:

• Customer data
• Buyer data
• Design data
• Order records

The announcement suggests that these assets, which include both customer-facing information and internal corporate assets, are now in the possession of the threat actor.

About Lorenzoni Store

Lorenzoni Store is an Italy-based clothing and textile retailer. Operating under Maglificio Liliana, the company specializes in knitwear and high-quality apparel products.

Security implications and risks

The allegations made by the Stormous group carry significant risks for the organization and its stakeholders. For the customers and buyers of Lorenzoni Store, the potential exposure of personal information increases the risk of identity theft and fraudulent activities. Because the organization is based in Italy, this incident may trigger specific legal obligations, as the company may be subject to data breach notification requirements under the General Data Protection Regulation (GDPR).

The nature of the Stormous group is a notable factor in this incident. Given the group's history of politically motivated actions, there is a possibility that the stolen data could be utilized not only for the purpose of extortion through ransom but also as a tool to damage the reputation of the organization. Furthermore, the leaked data could be used in secondary attacks, such as targeted phishing campaigns aimed at the company's clients or partners.

Considering the past activities of the Stormous group, this incident could potentially have negative impacts on supply chain security. In the broader context of cybersecurity, ransomware groups often employ double extortion tactics, where they not only encrypt an organization's systems but also threaten to leak sensitive data to pressure the victim into paying. This dual approach increases the pressure on companies to comply with ransom demands to avoid public exposure and reputational harm.

For organizations operating in the retail and e-commerce sectors, maintaining robust security postures is essential to mitigate these risks. Common defensive strategies include implementing multi-factor authentication (MFA), maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Furthermore, ensuring compliance with regional data protection laws is a critical component of managing the legal and reputational fallout from potential data breaches.