VanHelsing claims data breach at studiocdlvallone.it

• Ransomware group: VanHelsing
• Country: Italy
• Sector: Professional Services
• Announcement date: March 24, 2025

VanHelsing claims a data breach at studiocdlvallone.it

The ransomware group known as VanHelsing has listed the Italian professional services firm studiocdlvallone.it on its leak site. According to the group's announcement, the organization has been compromised, and they claim to have exfiltrated personal data belonging to the firm's clients.

This incident follows a common pattern observed in modern cyberattacks known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release stolen data on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information, which could lead to significant legal, financial, and reputational damage.

Details of the alleged attack

The threat actor listed studiocdlvallone.it on their leak site on March 24, 2025. The group has issued a ransom demand, although the specific amount of the demand was not disclosed in the announcement. The group alleges that they have successfully exfiltrated personal data belonging to the firm's clients.

The attackers have issued a direct threat regarding the consequences of non-compliance. It is stated that failure to pay the ransom may result in the full disclosure of the stolen data. Furthermore, the group has threatened that the deletion of encryption keys may occur if their demands are not met, which would prevent the organization from accessing its own data.

Data types involved in the claim

Based on the file tree structure shown in the screenshots provided by the attackers, the breach appears to involve access to various administrative documents. The following types of data are identified as being involved in the claim:

• Payroll records
• Employee and client personal data
• Administrative contracts

The presence of these documents, including specific mentions of monthly payroll details (Dettaglio paghe mensili), suggests that the attackers have gained access to sensitive internal and client-facing information.

About studiocdlvallone.it

Studio CDL Vallone is an accounting and tax consultancy firm based in Turin, Italy. The company provides professional services including accounting, tax planning, and corporate consultancy to businesses.

Impact and organizational implications

The alleged data breach may pose a significant risk of exposure for sensitive financial and personal information belonging to the firm's clients and employees. Because the firm is based in Italy, the incident may trigger legal obligations under the European Union's General Data Protection Regulation (GDPR), which mandates strict protocols for handling and reporting the compromise of personal data.

The potential publication of such data could lead to secondary risks for the affected clients, including the possibility of identity theft and targeted phishing attacks. Such attacks often leverage the specific details found in leaked administrative or financial documents to appear more convincing to the victim.

While information regarding the specific capabilities and history of the VanHelsing group remains limited, the nature of the ransom demand and the threat of data disclosure may negatively impact the firm's operational continuity and reputation. For organizations operating in the professional services sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining offline backups, conducting regular security audits, and ensuring strict adherence to data protection regulations to mitigate the impact of potential breaches.