threeam ransomware group lists leonardo.com on its leak site

• Ransomware group: threeam
• Country: Italy
• Sector: Technology
• Announcement date: February 13, 2025

The technology and defense company Leonardo has been listed on the leak site of the threeam ransomware group. This announcement, made by the threat actor group, follows a claim of a successful cyberattack against the organization's network.

The claimed attack by threeam

On February 13, 2025, the threeam group announced the Leonardo organization on their leak site. The group claims to have conducted a cyberattack against the organization's network, with the alleged attack date being January 15, 2025. While the group has made this public claim, information regarding the identity and specific operations of this group remains limited in the public domain.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information on public platforms if their demands are not met. This method increases the pressure on the victim by threatening their reputation and legal standing.

Information regarding the alleged data leak

Regarding the specifics of the breach, the listing provides very little detail. No information or screenshots regarding the nature of the allegedly leaked data have been provided by the group. Furthermore, there is no information available concerning the total size of the data, the specific file count, or the ransom demand requested by the attackers.

• The listing names no specific data types.

In many high-profile ransomware incidents, the lack of immediate detail from the threat actor can make it difficult for incident responders to determine the exact scope of the exposure during the initial stages of an investigation. Without verified screenshots or file lists, the actual contents of the alleged breach remain unconfirmed.

About Leonardo

Leonardo is a global aerospace, defense, and security company providing helicopters, security electronics, aeronautics, and space defense systems. Founded in 1948, the company is headquartered in Rome, Italy.

Risk assessment and industry implications

The claim made by the threeam group may bring a risk of exposure for the organization's sensitive defense and technology data. Because Leonardo is an Italy-based entity, a potential data breach could lead to legal consequences under the General Data Protection Regulation (GDPR). Such regulations impose strict requirements on how organizations handle and protect personal data, with significant penalties for non-compliance or failure to secure sensitive information.

Beyond the immediate organizational impact, there are significant secondary risks. Employees and business partners of the organization may face risks such as identity theft or targeted phishing attacks if personal or professional credentials are compromised. Furthermore, a security breach at an organization operating in the defense sector could potentially create negative impacts on the supply chain, as these entities are often deeply integrated with various government and private partners.

For organizations operating in critical sectors like defense and technology, maintaining robust cybersecurity postures is essential. Common defensive steps often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee awareness training to mitigate the risk of phishing. However, the accuracy of the claims made by the threeam group and the true scope of any leaked data have not yet been verified by independent sources.