Mercatino https://www.mercatinousato.com Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 11 June 2024 a ransomware group known as ransomhub listed Mercatino (https://www.mercatinousato.com) on its leak site, claiming to have taken internal files during an attack. The number of people whose information may be involved remains unknown, yet anyone who has bought, sold or registered on the platform has a practical reason to pay attention: personal and transactional records held by such a service can be used for fraud, phishing or identity misuse if they surface.

Public detail is limited. The listing itself is a claim by the group rather than an independently verified confirmation, and no further official statement from the organisation has been incorporated into the available record.

Breaking down the breach

According to the ransomhub listing reported on 11 June 2024, the group asserts that it exfiltrated internal files from Mercatino in a ransomware attack. The entry records a claimed data size of 1.5 TB and notes 87 visits to the listing page. The “Published” field is marked False, indicating that the group had not released the material at the time of the report. No technical method of intrusion, no timeline of the compromise, and no confirmed count of affected individuals appear in the public facts. The scale and precise contents therefore remain unconfirmed beyond the group’s own assertions.

The group behind it: ransomhub

Ransomhub is a ransomware operation that emerged publicly in 2024 after the disruption of another major group. Like many contemporary ransomware crews, it typically operates a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. The group has listed numerous organisations across different sectors, often advertising claimed data volumes and offering samples or full dumps once deadlines pass. Its listings are promotional claims intended to pressure victims; they do not automatically prove that every file described was obtained or that the data has been released. In this case the listing for Mercatino follows the same pattern—asserting exfiltration of internal files without independent corroboration of the full scope.

Who is Mercatino https://www.mercatinousato.com?

Mercatino operates an online marketplace focused on second-hand goods, a common model in Italy and elsewhere for private sellers and buyers to exchange used items. Platforms of this type ordinarily maintain user accounts, contact details, transaction histories, payment-related information and internal operational records. Because the service sits between private individuals, a compromise can expose both customer data and the organisation’s own administrative files. The consequential nature of any breach here stems from that dual role: personal information of ordinary users may sit alongside business records, increasing the potential for downstream misuse even when exact contents stay unconfirmed.

The information in question

The available facts state only that internal files were claimed to have been exfiltrated. No further breakdown of data types—such as names, addresses, emails, phone numbers, financial details or identity documents—is provided. Organisations running second-hand marketplaces typically hold registration data, messaging logs, sales records and internal documents; however, whether any of those categories were among the 1.5 TB claimed by ransomhub remains unverified. The exact contents are therefore unconfirmed, and readers should treat any specific description beyond “internal files” as speculative until independent evidence appears.

What's at stake

For individuals, the primary risks are secondary fraud and social-engineering attacks. If contact details or transaction histories were among the files, criminals could craft convincing phishing messages that reference real purchases or account activity. Identity-related information, if present, could support account takeovers elsewhere. For the organisation the stakes include operational disruption, potential regulatory scrutiny under data-protection rules, and loss of user trust. Because the group has not marked the data as published, the material may still be held privately or used only for leverage; that status can change without notice. The absence of a confirmed victim count means the circle of potentially affected people cannot yet be defined, leaving both users and the company in a period of uncertainty.

What to do if you're exposed

Anyone who has used Mercatino should treat the listing as a prompt for basic hygiene rather than confirmed compromise. Change the password on the platform and on any other accounts that share the same credentials. Enable multi-factor authentication wherever it is offered. Monitor bank and card statements for unexpected activity and be sceptical of unsolicited messages that claim to relate to past sales or purchases. Consider placing a fraud alert with credit-reference agencies if you believe sensitive identity data may have been involved. Finally, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check provides an additional, independent signal while the full picture of this incident remains incomplete.

AICompiled with AI assistance from public sources and published under our editorial standards.