HostingPerTe Listed by malas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 09, 2023, the Italian hosting provider HostingPerTe was listed by the ransomware group known as malas. Public reporting states that the incident involved the exfiltration of internal files and that attackers used a Zimbra vulnerability. The number of people affected remains unknown, and wider details about the scale and full scope of the event have not been disclosed.

The listing itself is a claim by the group rather than an independently confirmed account of every element of the intrusion. For customers and partners of a hosting firm, any reported exfiltration of internal material raises practical questions about what systems were reached and what information may now sit outside the organisation’s control.

Inside the incident

According to the available record, HostingPerTe appeared on a malas leak-site listing dated April 09, 2023. The reported summary indicates that the attackers exploited a Zimbra vulnerability and that internal files were exfiltrated as part of a ransomware attack. No public figure has been given for the volume of data taken, the number of systems involved, or the precise timeline of initial access, dwell time, or encryption activity.

Whether ransom negotiations occurred, whether any data was subsequently published beyond the listing claim, and whether the organisation restored operations from backups or other means are all undisclosed in the facts at hand. The only concrete technical detail supplied is the stated use of a Zimbra vulnerability; no further description of the exploit chain, affected versions, or lateral-movement steps has been released in the material provided.

Inside malas

Malas is known publicly as a ransomware operation that follows the familiar double-extortion pattern used by many contemporary groups: gain access, exfiltrate data, encrypt systems where possible, and then pressure the victim by threatening to release or auction the stolen material. Like other actors in this category, the group maintains a leak site on which it posts victim names and, in some cases, samples or larger archives of claimed data.

Public reporting on malas has generally described opportunistic targeting rather than highly selective campaigns against a single sector. The group’s listings function as both proof-of-compromise claims and leverage. In the present case, the appearance of HostingPerTe on that listing constitutes the group’s assertion that it held internal files from the organisation; independent verification of the full contents or the success of any encryption stage is not supplied in the available facts. No statements attributed to malas beyond the act of listing itself are recorded here.

Who is HostingPerTe?

HostingPerTe is a hosting provider. Organisations in this sector typically supply web hosting, email services, virtual private servers, domain-related services, and associated management tools to businesses and individuals. Because they sit between customers and the public internet, hosting companies routinely hold administrative credentials, configuration data, customer account records, billing information, and, in many cases, the content or backups of hosted websites and mailboxes.

A breach at a hosting provider is consequential precisely because of that intermediary role. Compromised internal systems can expose not only the provider’s own corporate data but also information belonging to multiple downstream customers. Even when the exact holdings are unconfirmed, the sector’s normal data footprint means that an intrusion carries potential ripple effects beyond a single corporate network.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, databases, or customer-specific records has been disclosed. It is therefore not possible to assert that any particular category—such as customer credentials, payment card data, email contents, or identity documents—was or was not included.

Hosting providers of this kind ordinarily maintain customer account databases, service-configuration files, support tickets, billing records, and administrative access logs. They may also store or have access to customer website files and email data. Those categories represent the typical risk surface; they are not confirmed contents of the HostingPerTe exfiltration. The precise inventory of what left the network remains unconfirmed.

What's at stake

For individuals and businesses whose data may have been held by HostingPerTe, the concrete risks include unauthorised use of account credentials, targeted phishing that references real service details, and potential exposure of any personal or commercial information stored in hosted environments. Because the number of people affected is unknown and the file list is undisclosed, the practical exposure for any single customer cannot be quantified from public information alone.

For the organisation itself, the stakes include operational disruption, the cost of investigation and remediation, possible regulatory notification duties, and erosion of customer trust. Ransomware incidents that involve exfiltration also create ongoing uncertainty: even after systems are restored, the fact that copies of internal files may exist outside the company’s control leaves open the possibility of later misuse or further leaks. None of these outcomes is asserted as having already materialised; they are the ordinary consequences that follow when internal material is claimed to have been taken.

If your data was in this claimed breach

If you used HostingPerTe services around the time of the reported incident, treat the event as a prompt to review your own exposure. Change passwords associated with any accounts on the platform, enable multi-factor authentication where it is available, and monitor financial and email accounts for unusual activity. Be cautious of messages that appear to reference the breach or that urge urgent action; such messages are a common follow-on tactic.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or deny involvement in this specific incident, but it provides a practical way to see whether your credentials or personal details appear in publicly compiled breach collections and to decide what further precautions to take.

AICompiled with AI assistance from public sources and published under our editorial standards.