Lubiam Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For customers, suppliers, employees and partners of the Italian clothing firm Lubiam, the appearance of the company’s name on a ransomware group’s leak site raises immediate practical questions: whether internal files containing personal or commercial information have been taken, and what that could mean for privacy, contracts or day-to-day operations. Public detail remains limited, yet the listing itself is enough to warrant careful attention from anyone whose data may have been held by the firm.

On 4 May 2025 Lubiam was reported as listed by the sarcoma ransomware group. The group claims that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and no further confirmed inventory of the material has been released. The episode therefore sits at the intersection of an unverified claim and the ordinary risks that accompany any organisation holding business and personal records.

Inside the incident

According to the available record, Lubiam was listed by the sarcoma ransomware group on 4 May 2025. The group asserts that the incident involved a ransomware attack in which internal files were exfiltrated. No public confirmation of the attack method, the precise date of intrusion, the volume of data taken, or any ransom demand has been provided. The number of individuals potentially affected is listed as unknown. Beyond the claim of internal-file exfiltration, the contents of those files have not been itemised in the public reporting. In short, the incident is known principally through the group’s leak-site listing; independent verification of the scale or technical details remains undisclosed.

Who is sarcoma?

Sarcoma is a ransomware operation that has appeared in public reporting as a double-extortion group: it encrypts systems and simultaneously claims to steal data, then threatens to publish the material if a ransom is not paid. Like many such actors, it maintains a leak site on which it lists victims and, in some cases, releases sample files or full archives. The group’s listings are claims made by the operators themselves; they are not independent confirmations of a breach. Sarcoma has been observed targeting organisations across multiple sectors and geographies, typically relying on initial access obtained through common vectors such as compromised credentials or unpatched services, followed by lateral movement and data staging. No statements attributed to sarcoma specifically about Lubiam beyond the listing itself appear in the public facts, so any further characterisation of this particular claim would be speculative.

About Lubiam

Lubiam is an Italian company whose management remains in the hands of the family of its founder, Luigi Bianchi. The firm traces its origins to 1911, when Bianchi, then a young tailor who had left his hometown of San Michele in Bosco in the province of Mantua to train in Turin, opened the “Primaria Sartoria Luigi Bianchi,” a men’s tailoring and women’s suits business. Over more than a century the enterprise has grown into a recognised name in Italian menswear and formal clothing, continuing a family tradition that began with Bianchi’s father and grandfather, who worked as travelling tailors and barbers in the countryside villages. As a clothing manufacturer and retailer, Lubiam operates in a sector that routinely handles customer orders, supplier contracts, employee records, design and production data, and commercial correspondence. A breach at such an organisation is consequential because those categories of information, if exposed, can affect both individuals and the firm’s commercial relationships.

What data was at risk

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” No further breakdown—such as customer databases, employee payroll files, financial records, or design documents—has been disclosed. Organisations of Lubiam’s type typically hold customer contact and order information, supplier and logistics data, employee personal and payroll details, and proprietary product or production materials. Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, were among the files claimed to have been taken. The absence of a detailed inventory means that any assessment of exposure must treat the claim of internal-file exfiltration as the sole confirmed description.

The real-world impact

For individuals whose information may have been held by Lubiam, the practical risks include potential misuse of contact details, identity-related fraud if personal identifiers were present, or unwanted commercial approaches if customer lists were involved. Employees could face risks associated with payroll or personnel data. Suppliers and business partners might see contractual or pricing information used for competitive advantage or social-engineering attempts. For the organisation itself, the consequences can include operational disruption from ransomware encryption, reputational damage, regulatory scrutiny under European data-protection rules, and the cost of investigation and remediation. Because the number of people affected and the precise data types remain unknown, the scale of these risks cannot yet be quantified; the prudent stance is to treat the possibility of exposure as real until clearer information emerges.

What to do if you're exposed

Anyone who has done business with, worked for, or supplied Lubiam should monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be alert to phishing messages that reference the company or recent orders. If you receive notification from Lubiam itself, follow the guidance it provides. Changing passwords that may have been reused across services is a sensible precaution. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; such a check offers a quick, independent way to gauge whether further steps are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.