SIT Group / Robusta Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 5, 2026, the ransomware group medusalocker listed SIT Group, an Italian company operating sitgroup.it, and the Bulgarian firm Robusta at robusta.bg on its leak site. The entry states that internal files were taken during a ransomware operation. The number of people affected is not reported. This development fits a pattern in which ransomware actors publish victim names to increase pressure during negotiations. Details beyond the listing itself remain limited.

Breaking down the breach

The only confirmed information is the May 2026 listing itself. The group asserts that files were removed from the two companies. No figures for data volume, encryption status, or ransom demands appear in public records. Timing of the initial intrusion and any subsequent contact between the actors and the companies is undisclosed.

The group behind it: medusalocker

Medusalocker is a ransomware operation that has conducted multiple campaigns since at least 2020. Public reporting describes its use of double-extortion tactics: encrypting systems and copying data before demanding payment. The group maintains a leak site where it lists organizations it claims to have targeted. Its listings function as a form of public pressure rather than verified proof of compromise.

Who is SIT Group / Robusta Listed by medusalocker Ransomware Group?

SIT Group is an Italian business with an online presence at sitgroup.it. Robusta operates from Bulgaria under robusta.bg. The listing also references abv.bg email addresses, suggesting possible operational links between the entities. Companies of this profile typically manage internal business systems, client records, and communications infrastructure across borders.

What data was at risk

The listing names only “internal files exfiltrated in ransomware attack.” No further categories such as customer records, employee data, or financial documents are specified. Organizations in similar sectors commonly store contracts, correspondence, and operational records, yet the precise contents of the claimed exfiltration remain unconfirmed.

What's at stake

Stolen internal files can contain details useful for follow-on attacks against the same organizations or their partners. If personal information is present, affected individuals may face increased risk of targeted phishing or account misuse. For the companies, the incident adds costs related to investigation, potential regulatory reporting, and restoration of systems.

Were you affected?

Individuals who have corresponded with sitgroup.it, robusta.bg, or abv.bg addresses can monitor those accounts for unusual activity. Checking whether an email address appears in public breach repositories provides one practical starting point. Several services offer free scans against known data sets for this purpose.

AICompiled with AI assistance from public sources and published under our editorial standards.