GEG Telecomunicazioni Listed by netrunner Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
GEG Telecomunicazioni has been listed by the netrunner ransomware group, with internal files reported exfiltrated. The incident was disclosed on 03 April 2026; anyone who has shared data with the company should verify whether their information has been exposed and review their accounts for unusual activity.
Inside the incident
The only confirmed detail is the listing itself and the claim that files were taken. No date of intrusion, volume of data, or method of initial access has been disclosed. The listing provides no sample files or additional technical indicators beyond the assertion that internal material was removed.
Who is netrunner?
Netrunner is a ransomware operation that has appeared on multiple leak sites since at least 2024. Like other groups using double-extortion tactics, it typically encrypts systems and then publishes or threatens to publish stolen data when a ransom demand is not met. Its targets have included organisations in Europe and North America across several sectors. The group’s listings are presented on its own site and are not independently verified by third parties at the time of posting.
About GEG Telecomunicazioni
GEG srl, founded in 1981, designs and supplies mobile radio systems used by public administrations in Italy. It has provided equipment and support to more than 500 public bodies and manages over 100,000 radios. Since 2004 the company has been the exclusive Italian distributor for DAMM TETRA products and holds a substantial share of the civilian TETRA market, including more than 350 base stations. TETRA networks are used for operational communications by emergency services and other public entities.
What was likely exposed
The listing refers only to “internal files.” No inventory of specific data categories has been released. Organisations that design and maintain radio systems for public administrations commonly hold network diagrams, configuration files, customer records, and operational documentation. The precise contents of the exfiltrated material remain unconfirmed.
Why it matters
Exposure of internal files from a supplier of public-safety radio systems can reveal details about network architecture and access procedures used by multiple government bodies. Such information may assist further targeting or reconnaissance. For individuals whose data appears in customer or operational records, the main risks are misuse of contact details or credentials if those records were among the files taken. The absence of a confirmed count of affected people leaves the scale of personal exposure unknown.
Were you affected?
Check any official statements issued by GEG Telecomunicazioni or your local public-administration contact. Individuals can also run a free exposure scan of their email address against known breach data sets to see whether their information has appeared in previously published collections. If credentials or personal details are found, change passwords and enable multi-factor authentication on associated accounts.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Jordan India Fertilizer Company Listed by netrunner Ransomware GroupHarman Fitness Listed by netrunner Ransomware GroupNippon Medical School Musashi Kosugi Hospital Listed by netrunner Ransomware GroupShiraume Hospital Listed by netrunner Ransomware GroupLatest breaches
Publicly posted by netrunner — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.