Gitlabs: INGV, Spacemanic, Squeezer-software Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 12, 2025, the ransomware group known as fog listed Gitlabs: INGV, Spacemanic, Squeezer-software on its leak site, claiming a ransomware attack that involved the exfiltration of internal files. The number of people affected remains unknown, and public detail on the incident is limited to this listing and the reported nature of the data taken.

The listing presents the three entities as a single conglomerate target. Because the claim originates from the threat actor’s own site, it has not been independently confirmed in the available record. The episode matters because the organisations operate in scientific research, satellite manufacturing and cloud-blockchain tooling, sectors that routinely handle sensitive technical and operational material.

Inside the incident

According to the reported summary, fog claims to have carried out a ransomware attack against Gitlabs: INGV, Spacemanic, Squeezer-software and to have exfiltrated internal files. The date the listing appeared is February 12, 2025. No further technical details—such as the initial access method, the duration of the intrusion, the volume of data removed, or any ransom demand—have been disclosed in the public record. The number of individuals whose information may have been involved is listed as unknown. The only concrete assertion available is that internal files were taken as part of the claimed attack.

Who is fog?

Fog is a ransomware group that has operated in the public domain by listing victims on dedicated leak sites and threatening to publish stolen data if demands are not met. Like other groups in this category, it typically combines data theft with encryption of systems, using the dual pressure of operational disruption and potential public exposure. Its prior activity has included claims against organisations across multiple sectors, though each listing remains an unverified assertion by the group itself until corroborated by the victim or independent investigation. In this case, the group claims Gitlabs: INGV, Spacemanic, Squeezer-software as a victim; no additional statements attributed to fog about this specific incident appear in the available facts.

Who is Gitlabs: INGV, Spacemanic, Squeezer-software?

The name refers to a reported conglomerate of three specialised organisations. INGV is the Italian National Institute for Geophysics and Volcanology, a public research body focused on earth sciences, seismic monitoring and volcanic risk. Spacemanic is a Slovak company that designs and produces small and nano-satellites. Squeezer provides a decentralised platform intended to help developers deploy applications across multi-cloud and blockchain environments. Together they span scientific research, aerospace hardware and cloud-infrastructure tooling. Organisations of this kind typically maintain research data, technical designs, project documentation, employee records and operational systems. A breach claim against such a grouping raises concerns about both scientific and commercial confidentiality as well as any personal data that may reside in internal systems.

What was likely exposed

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, databases or personal-data categories has been disclosed. Organisations operating in geophysics research, satellite production and multi-cloud platforms commonly hold technical reports, design files, source code or configuration data, research datasets, employee and contractor information, and project correspondence. Whether any of those categories were among the files taken remains unconfirmed. The exact contents of the exfiltrated material are therefore unknown.

What's at stake

For individuals whose data may have been present in internal systems, the practical risks include potential misuse of contact details, credentials or other personal identifiers if such material was included among the files. For the organisations themselves, the exposure of internal technical or research material could affect ongoing projects, intellectual property and operational security. Because the scale of the incident and the precise data types remain undisclosed, the concrete impact cannot yet be quantified. The listing itself may also prompt scrutiny from partners, funders and regulators who rely on the integrity of these institutions’ systems.

Were you affected?

If you have worked with, contracted for, or otherwise shared information with INGV, Spacemanic or Squeezer-software, consider the following practical steps:

• Monitor official statements from the organisations for any confirmation or guidance.
• Change passwords on accounts that may have been used in connection with these entities and enable multi-factor authentication where available.
• Watch financial and email accounts for unusual activity in the coming months.
• Run a free exposure scan of your email address against known breach datasets to check whether your information has already appeared in public leak collections.

Public detail remains limited; any further verified information will come from the organisations themselves or from independent investigations rather than from the threat actor’s claims alone.

AICompiled with AI assistance from public sources and published under our editorial standards.