Studio Rossetti e Partners Listed by malas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional service firms that rely on shared collaboration platforms, turning routine software flaws into leverage for data theft and extortion. In this climate, even smaller practices can find themselves named on leak sites after attackers exploit known vulnerabilities in widely used mail systems.

On 9 April 2023, the organisation Studio Rossetti e Partners was listed by the ransomware group malas. Public reporting states that internal files were exfiltrated in a ransomware attack that used a Zimbra vulnerability. The number of people affected remains unknown, and many operational details have not been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope is limited.

Inside the incident

According to the available record, Studio Rossetti e Partners appeared on a malas leak-site listing dated 9 April 2023. The reported summary indicates that attackers used a vulnerability in Zimbra, a common email and collaboration platform, and that internal files were exfiltrated as part of a ransomware attack. No public figure has been given for the volume of data taken, the precise duration of unauthorised access, or the number of individuals whose information may have been involved. Timing beyond the report date, the specific Zimbra flaw exploited, and any ransom demand or negotiation outcome are undisclosed in the material at hand. What is stated is limited to the claim of exfiltration of internal files following exploitation of the Zimbra vulnerability.

Because the public account rests largely on the group’s listing and a brief reported summary, the incident should be treated as an asserted compromise rather than a fully independently documented event. Organisations facing such claims typically investigate internally, notify relevant authorities where required, and assess whether personal or client data left their systems. Those steps, if taken, have not been detailed in the facts provided.

The group behind it: malas

malas is a ransomware actor that has operated by compromising networks, encrypting systems or threatening to publish stolen data, and listing victims on dedicated leak sites to increase pressure. Like other groups in this category, it commonly seeks initial access through exposed services, unpatched software, or stolen credentials, then moves laterally to locate and copy valuable files before deploying ransomware or issuing extortion demands. Public reporting on such groups consistently shows a preference for organisations that hold concentrated collections of internal documents, client records, or operational data, because those materials can be used both for leverage and for secondary sale or exposure.

In this case, malas claims to have listed Studio Rossetti e Partners after a ransomware attack involving exfiltration of internal files and the use of a Zimbra vulnerability. No further statements attributed specifically to the group about this victim—such as sample file dumps, exact data volumes, or deadlines—are included in the facts. Readers should therefore regard the listing as the group’s assertion pending any fuller verification by the organisation or independent researchers.

Studio Rossetti e Partners and its sector

Studio Rossetti e Partners is a professional practice. Firms of this type—often legal, accounting, consulting, or multi-disciplinary studios—routinely handle correspondence, contracts, financial working papers, client identity documents, and internal administrative records. They typically depend on email and collaboration platforms such as Zimbra to coordinate work among partners, staff, and external clients. That concentration of sensitive material, combined with the need for remote access and shared mailboxes, makes such practices attractive targets for ransomware operators seeking both disruption and exfiltrated data.

A breach affecting a professional studio can have consequences beyond the firm itself. Clients may face exposure of confidential matters; counterparties named in documents may be drawn into secondary risk; and the firm’s own ability to meet professional secrecy and data-protection obligations can be called into question. Even when the precise contents of stolen files remain unconfirmed, the sector’s typical data holdings explain why listings of this kind attract attention from regulators, insurers, and affected individuals.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown—such as whether the files included client personal data, financial records, authentication credentials, or purely administrative material—has been disclosed. The number of people affected is unknown.

Organisations of this kind commonly hold names, contact details, identity documents, contractual and case-related correspondence, billing information, and internal memoranda. It is therefore reasonable to expect that some mixture of business and personal information could have been present on systems accessible via the compromised Zimbra environment. However, the exact contents remain unconfirmed. No inventory of file types, record counts, or categories of personal data has been published in the material available for this account. Any assessment of what specifically left the organisation must await official statements from Studio Rossetti e Partners or competent authorities.

Why it matters

For individuals whose details may have been among the internal files, the practical risks include unwanted contact, phishing that references genuine matters, and, in more serious cases, identity misuse or fraud. Because professional firms often retain long-running client histories, older documents can still contain usable personal identifiers years after a matter closes. Even without confirmation of specific data types, the mere claim of exfiltration creates a period of uncertainty during which affected people may wish to heighten monitoring of accounts and correspondence.

For the organisation, the consequences include potential regulatory notification duties, contractual obligations to clients, reputational harm, and the cost of investigation, remediation, and possible system rebuilding. Ransomware incidents that begin with a known platform vulnerability also underscore the ongoing pressure on smaller practices to keep collaboration software patched and access tightly controlled—pressures that many firms manage with limited dedicated security resources. None of these outcomes establish negligence as a proven fact; they simply describe the ordinary stakes when internal files are alleged to have left a professional environment.

Were you affected?

If you have been a client, employee, or counterpart of Studio Rossetti e Partners, treat the public claim seriously but calmly. Monitor bank and email accounts for unusual activity, be cautious of messages that reference the firm or recent matters, and consider placing fraud alerts with relevant credit or identity services where available in your jurisdiction. If the firm issues official guidance or breach notifications, follow the instructions provided there. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets, which may help you decide what further steps to take.

AICompiled with AI assistance from public sources and published under our editorial standards.