Order of Psychologists of Lombardy Listed by noescape Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional and regulatory bodies across Europe, treating membership organisations as sources of concentrated personal and operational data. In that landscape, the Order of Psychologists of Lombardy was listed in late September 2023 by the group known as noescape, which claimed a successful encryption and exfiltration attack against the organisation’s network.

Public detail remains limited. What is known comes chiefly from the group’s own leak-site claims and secondary reporting dated 30 September 2023. The number of people affected is unknown, and the precise contents of any stolen material have not been independently confirmed. For members, staff, and anyone who has dealt with the Order, the incident still warrants clear attention because professional regulators routinely hold sensitive identity and contact information.

Breaking down the breach

According to reporting tied to the listing, noescape claimed that the Order of Psychologists of Lombardy’s network was successfully encrypted and compromised, and that internal files were exfiltrated. The group’s partial public statement asserted that management had remained silent and was denying the incident; that wording is the group’s claim, not an independent finding. The report date associated with the listing is 30 September 2023.

No verified figure has been published for the number of individuals affected. Technical details of the initial access method, the duration of any dwell time, and the full scope of systems involved have not been disclosed in the available record. Independent confirmation of the encryption event or of the volume of data taken is likewise absent from the facts at hand. The incident is therefore best understood as a claimed ransomware operation with alleged data theft, pending fuller official disclosure.

The group behind it: noescape

Noescape is a ransomware operation that emerged in the public threat landscape in 2023. Like other groups in this category, it has typically combined network encryption with data exfiltration and the threat of leak-site publication to pressure victims. The group has used a dedicated leak site to name organisations it claims to have compromised and, in some cases, to release sample files or larger archives when negotiations stall.

Public reporting on noescape has described a Ransomware-as-a-Service style model and double-extortion tactics familiar from other contemporary crews: encrypt systems, steal data, then threaten exposure. Those patterns are well-documented across multiple victims and should not be read as confirmed specifics unique to this case beyond what the listing itself states. Regarding the Order of Psychologists of Lombardy, the only attributable claim in the record is that the network was encrypted and compromised and that internal files were taken; any further characterisation of negotiations or of the organisation’s response remains the group’s assertion.

About Order of Psychologists of Lombardy

The Order of Psychologists of Lombardy is the professional regulatory body for psychologists in the Lombardy region of Italy. Bodies of this kind maintain registers of qualified practitioners, handle licensing and disciplinary matters, and communicate with members and the public about professional standards. They typically sit at the intersection of healthcare-related regulation and public administration.

Because such organisations collect and store information needed to verify credentials, manage membership, and conduct oversight, a breach affecting them can touch both the professionals on the register and the administrative apparatus that supports them. The consequential nature of an incident here stems less from commercial brand damage than from the trust placed in a regulator that holds identity, contact, and professional-status data for a large regional cohort of practitioners.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases, or record categories has been disclosed. The number of people affected is unknown.

Organisations of this type commonly hold membership registers, contact details, identification or registration numbers, correspondence related to licensing or complaints, and internal administrative documents. It is reasonable to expect that some combination of those categories could have been present on the network, but it is not established which of them, if any, were actually taken. Exact contents remain unconfirmed; readers should treat any specific claim about named data fields as unverified unless the Order or a competent authority publishes a fuller inventory.

What's at stake

For individuals whose information may have been involved, the practical risks include unwanted contact, phishing that impersonates the Order or related health bodies, and the long-term recirculation of personal or professional details in criminal markets. Even limited internal files can contain enough context—names, email addresses, registration status—to make social-engineering attempts more convincing.

For the organisation, the stakes include disruption of member services, the cost and complexity of incident response and system recovery, and the need to communicate accurately with a professional community that depends on the integrity of the register. Regulatory and reputational pressure can follow any confirmed compromise of a public-interest body, regardless of whether negligence is ever established. None of these outcomes is proven at scale from the current record; they are the ordinary consequences that follow when a ransomware group claims both encryption and exfiltration against a membership organisation.

If your data was in this claimed breach

If you are a member, employee, or correspondent of the Order of Psychologists of Lombardy, treat the listing as a prompt for caution rather than proof that your own record was taken. Practical first steps include:

• Monitor official channels from the Order for any breach notification or guidance, and disregard unsolicited messages that pressure you to click links or supply credentials.
• Be alert to phishing that references professional registration, fees, or disciplinary matters; verify any such contact through known good channels.
• Change passwords on accounts that reused credentials tied to Order-related email, and enable multi-factor authentication where available.
• Watch financial and identity accounts for unusual activity if you have ever shared identity documents or payment details with the organisation.
• Consider running a free exposure scan of your email address to check whether it has already appeared in known breach datasets, and review any results against this and other incidents.

Public detail on this incident is still thin. Until the Order or independent investigators publish confirmed scope and data categories, the responsible posture is measured vigilance—not assumption that every member file may have been exposed, and not dismissal of the claim outright.

AICompiled with AI assistance from public sources and published under our editorial standards.