Larimart S.P.A Listed by crypto24 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Larimart S.P.A was listed by the crypto24 ransomware group on July 15, 2025, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; check the group’s data-leak site and Larimart’s official channels to see if your information was exposed and change any exposed passwords or enable multi-factor authentication.
People whose professional or personal details sit inside defence-sector files may now face questions about whether those records have left their intended systems. On 15 July 2025 the ransomware group crypto24 publicly listed Larimart S.P.A., claiming it had taken a large volume of internal material. The number of individuals affected remains unknown, and independent confirmation of the full contents is still limited, yet the nature of the claimed files—export controls, customer lists, and technical specifications—means ordinary staff, contractors and partners could find themselves exposed to identity or commercial misuse if the claim proves accurate.
This article sets out only what has been reported, attributes the group’s statements as claims, and explains the practical steps anyone who may be connected to the company can take while public detail stays incomplete.
What happened
According to the listing published by crypto24, Larimart S.P.A. was the target of a ransomware attack in which internal files were allegedly exfiltrated. The group stated that it had secured 2 TB of confidential data. The incident was reported on 15 July 2025. No independent verification of the volume, the precise date of intrusion, or the technical method used has been released in the available record. The number of people whose information may have been involved is listed as unknown. Public detail on whether systems were encrypted, whether a ransom demand was issued, or whether any data has already been released beyond the group’s claim remains undisclosed.
The group behind it: crypto24
crypto24 is a ransomware operation that follows the now-familiar double-extortion model: it claims to steal data before encrypting systems and then threatens to publish the material on a dedicated leak site if payment is not made. Like other groups of this type, it typically posts victim names, sample file lists and volume claims to pressure organisations. Prior public activity by crypto24 has centred on industrial and technology targets, with listings that emphasise the sensitivity of the stolen material. In the present case the group claims to hold 2 TB of Larimart material; that assertion has not been independently confirmed and should be treated as an unverified claim pending further evidence.
Larimart S.P.A and its sector
Larimart S.P.A. is an Italian company operating in the defence and security sector, focused on armour systems, ballistic protection and related vehicle and personal-protection technologies. Organisations of this kind routinely handle technical drawings, test results, export-control documentation, Ministry of Defence correspondence and supplier or customer lists. Because the work intersects with NATO-linked programmes and national export regimes, the data such a firm holds can include both commercial secrets and information subject to strict regulatory controls. A breach claim against a company in this position therefore carries consequences that extend beyond ordinary corporate records: it can affect supply-chain partners, government customers and individuals whose names appear in contracts or field-test documentation.
What data was at risk
The only concrete description available comes from crypto24’s own listing. The group claims the exfiltrated material comprises NATO-linked armour specifications and ballistic protection designs; EUC/EUS certificates and UAMA export-control documents; VTLM test data and confidential field-performance results from Santa Severa; strategic planning documents, internal pricing, MoD-related papers, invoices and tactical customer lists; and archives of confidential consortium contracts and weapon-system development records. These categories are presented solely as the group’s assertion. The exact contents, the presence or absence of personal identifiers, and whether any of the material has been released publicly remain unconfirmed. Organisations in the defence-supply sector typically retain employee and contractor contact details, project correspondence and financial records; whether such items formed part of the claimed 2 TB set is not stated in the available facts.
Why it matters
If the claimed files are genuine, individuals named in customer lists, invoices or consortium contracts could face targeted phishing, social-engineering attempts or commercial pressure. Export-control and technical documents, if misused, risk regulatory complications for the company and its partners. For Larimart itself the listing creates reputational and contractual exposure, potential scrutiny from defence customers, and the ordinary operational costs of investigation and remediation. Because the number of people affected is unknown and the precise data types remain unverified, the immediate risk is uncertainty: people who have worked with or for the firm cannot yet know whether their own details are involved.
What to do if you're exposed
Anyone who has a past or present connection to Larimart S.P.A.—employees, contractors, suppliers or customers—can take a small number of practical steps while waiting for clearer official information.
- Monitor bank and credit accounts for unexpected activity and enable transaction alerts where available.
- Treat unsolicited emails or calls that reference defence contracts, export paperwork or Santa Severa testing with heightened caution; verify any request through a known official channel.
- Change passwords on work-related and personal accounts that may have been reused, and enable multi-factor authentication.
- Request a free credit report or fraud alert from the relevant national credit bureau if you believe financial identifiers could be involved.
- Run a free exposure scan of your email address against known breach data sets to see whether it has already appeared in other incidents.
Public detail on this incident remains limited to the group’s claim and the 15 July 2025 listing date. Further confirmation from Larimart or independent investigators would be required before the full scope can be established. Until then, measured vigilance is the most useful response.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
U.S. Vanadium Holding Company LLC Listed by crypto24 Ransomware GroupGenerali Group Listed by crypto24 Ransomware GroupTan Chong Motor Holdings Berhad Listed by crypto24 Ransomware GroupIndustrias Guerra, S.A. Listed by crypto24 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Larimart S.P.A Listed by crypto24 Ransomware Group →
Publicly posted by crypto24 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.