Ransomware Activity

[manufacturer] Ernesto Malvestiti S.p.A. - a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM. The exposed material spans the company's entire operations: PAGHENET payroll database (1.1 GB SQL Server backup ×7 copies) - every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB ×5). GDPR Article 9 special-category data - medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce. 50+ plaintext OEM portal credentials stored in a single file called accesso web.txt - BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more. SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export. ADP payroll SFTP credentials stored in WinSCP.ini - the channel used to transmit employee salary data to the external payroll processor. 614 MB of financial/controlling data - consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships. 1.5 GB of engineering IP - 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts. 160+ client/supplier contracts with pricing, commercial terms, and executed NDAs. 560+ job candidate CVs with full names, addresses, phone numbers, and career histories.

ART SCHOOL: Dove la Creatività Prende Forma Benvenuti in Art School, il luogo dove il talento incon...