Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

IT · #5 of 183 countriesWatch Italy

Ransomware Attacks In Italy.

As of Oct 19, 2026, 787 organisations in Italy have been listed as ransomware victims on leak sites, 2.4% of all confirmed victims and rank 5 of 183 countries. The most active group here is Qilin.

Updated continuously · figures as of Oct 19, 2026
Confirmed victims
787
Share of all victims
2.4%
Rank
#5 of 183
Most active group
Qilin
Most hit sector
Manufacturing

Victims Posted Per Month.

Confirmed ransomware victims in Italy per month
MonthConfirmed victims
November 202511
December 202520
January 202616
February 202621
March 202630
April 202629
May 202621
June 202618
July 202624
August 202649
September 202621
October 2026 (month in progress)12

Most Active Groups Here

  1. Qilin678.5% of all victims
  2. LockBit 3.0648.1% of all victims
  3. The Gentlemen334.2% of all victims
  4. LockBit 5.0313.9% of all victims
  5. LockBit 2.0293.7% of all victims

Most Hit Industries Here

  1. Manufacturing8711.1%
  2. Consulting638.0%
  3. Technology435.5%
  4. Retail313.9%
  5. Media and Entertainment273.4%

Latest Victims.

All 787 victims in Italy →
Latest confirmed ransomware leak-site victims in Italy
VictimClaimed byCountryIndustryData claimedPosted
Mastelli S.r.l.
mastelli.com
QilinITItalyHealthcareNot stated
Brenner Base Tunnel
bbt-se.com
EverestITItalyTransportation and LogisticsNot stated
Alma Center Servizi Medicali S.r.l.
almacenter.it
Space BearsITItalyHealthcareNot stated
The Innovation Group
theinnovationgroup.it
PlayITItalyTransportation and LogisticsNot stated
Goccia S.p.A.
goccia.it
MajinahanashiITItalyRetailNot stated
Camandona SA
camandona.com
MajinahanashiITItalyUnknownNot stated
idi pharma
idipharma.com
DeadlockITItalyPharmaceuticalsNot stated
Melchioni Spa
melchioni.it
QilinITItalyRetailNot stated

Know When A Company In Italy, Or One Of Your Suppliers, Is Posted.

Brandefense alerts on leak-site posts for your brands and third parties, with the group's profile and IOC feeds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.