I.B.G SPA Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

I.B.G SPA, also referred to as IBGSPA Società Benefit, was listed by the ransomware group sarcoma on or around February 11, 2025. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further operational details have not been released. The listing itself is a claim by the group and has not been independently confirmed in the available record.

For an organisation of this size and sector, any confirmed compromise of internal material can raise practical concerns for employees, partners and customers. At present, the publicly known facts are limited to the group’s claim of a ransomware incident involving data theft and the organisation’s subsequent appearance on the actor’s leak site.

Inside the incident

According to the available record, I.B.G SPA was listed by sarcoma on February 11, 2025. The only data category named is “internal files exfiltrated in a ransomware attack.” No figure has been given for the volume of data taken, no specific file types or systems have been identified, and the number of individuals potentially affected is listed as unknown. Timing of the initial intrusion, the method of access, whether encryption was deployed, and any ransom demand remain undisclosed. The incident is therefore known only through the group’s public listing and the brief accompanying description of file exfiltration.

The group behind it: sarcoma

Sarcoma is a ransomware operation that has appeared in public threat reporting as a double-extortion actor. Like many contemporary groups, it typically claims to steal data before encrypting systems and then pressures victims by threatening to publish the material on a dedicated leak site. Listings on such sites are assertions by the group; they do not by themselves constitute independent verification that the claimed theft occurred or that the data will be released. Public knowledge of sarcoma’s broader activity includes the use of common ransomware tooling and the publication of victim names to increase leverage, but no specific statements by the group about I.B.G SPA beyond the listing itself are recorded in the facts provided here. Any further claims the group may make should be treated as unverified until corroborated by the organisation or independent investigators.

About I.B.G SPA

I.B.G SPA, operating as IBGSPA Società Benefit, is an Italian company that has grown steadily over three decades. Public information supplied with the breach report states that its turnover has exceeded 130 million euros. In 2019 the firm, together with PepsiCo Italia, received the Donald Kendall Award from PepsiCo New York, an honour given for strong economic, financial and commercial performance over a three-year period. The award was referenced by PepsiCo’s chief executive at the time. As a Società Benefit the company operates under an Italian legal form that combines commercial activity with stated social or environmental purposes. Organisations of this type commonly manage commercial contracts, logistics data, employee records, supplier information and customer or partner details related to beverage or consumer-goods distribution. A ransomware incident affecting such an entity therefore carries potential consequences for business continuity and for the privacy of individuals whose data may reside in internal systems.

What data was at risk

The facts name only “internal files exfiltrated in a ransomware attack.” No further breakdown—such as employee personal data, financial records, customer lists or proprietary commercial documents—has been disclosed. Organisations operating at I.B.G SPA’s scale and in its sector typically hold human-resources files, accounting material, supply-chain documentation and correspondence with commercial partners. Because the precise contents remain unconfirmed, it is not possible to state which of these categories, if any, were among the files taken. Readers should treat any subsequent claims about specific data types as unverified until the organisation or competent authorities provide clarification.

The real-world impact

For individuals whose information may have been present in the exfiltrated files, the principal risks are identity-related misuse, targeted phishing that references genuine internal details, and possible exposure of contact or employment data. Because the volume and exact nature of the material are unknown, the scale of any such risk cannot yet be quantified. For the organisation itself, the incident may involve operational disruption, contractual notification duties, regulatory scrutiny under European data-protection rules, and reputational effects with commercial partners. Recovery costs and any business interruption are likewise unquantified in the public record. Until more detail emerges, both individuals and the company face uncertainty rather than a fully mapped set of consequences.

If your data was in this claimed breach

If you have a past or present connection with I.B.G SPA—as an employee, contractor, supplier or customer—consider basic protective steps. Monitor financial and email accounts for unexpected activity, enable multi-factor authentication where available, and treat unsolicited messages that reference the company with caution. Change passwords on any accounts that may have shared credentials with workplace systems. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official statements from the organisation or Italian data-protection authorities remain the most reliable source for further guidance as the situation develops.

AICompiled with AI assistance from public sources and published under our editorial standards.