On February 07, 2023, the Italian winery operator Cantinatollo.it appeared on the LockBit 3.0 ransomware leak site, claiming that its internal files had been exfiltrated during an active ransomware attack. The listing indicates that data was stolen and is now publicly threatened with release unless the company meets the attackers’ demands. Anyone whose personal or financial details passed through the winery’s systems — customers, suppliers, employees, or partners — may now be exposed.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch cantinatollo.it
Get alerted the next time cantinatollo.it files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about cantinatollo.it’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details from the Listing
The LockBit 3.0 leak page states that Cantinatollo.it suffered a ransomware incident in which internal files were exfiltrated. The disclosure does not quantify the number of records affected, list specific data types beyond “internal files,” or reveal the exact date of initial compromise. It simply presents the company name, a short description of its 2,500-hectare vineyard operations, and a countdown timer typical of the group’s extortion playbook. No sample data appears to have been published at the time the listing went live.
Why This Matters for You and Your Family
When a business like a winery stores customer orders, supplier contracts, payment records, or employee information, that data often includes names, addresses, phone numbers, email addresses, and sometimes payment card details. If those records were taken, they can be sold or dumped on criminal forums. For ordinary people, this translates into higher risk of identity theft, phishing campaigns tailored to your recent wine purchases, or fraudulent charges on cards used for direct winery shipments. Even if you are not a direct customer, shared business partners or employees can create secondary exposure that reaches your household.
The Doxxing and Identity-Chain Risk
Ransomware leaks rarely stop at one company. Criminals frequently cross-reference stolen internal files against other breach datasets to build detailed profiles. An email address found in Cantinatollo’s files can be linked to accounts on shopping sites, social media, or gaming platforms. This chaining process turns a single breach into long-term doxxing material — home addresses tied to family names, children’s names gleaned from loyalty programs, or reused passwords that grant access to far more sensitive services. Credential leaks like this one cascade into account takeovers that can affect both adult and children’s gaming accounts when the same password or recovery email is reused.