On July 15, 2025, the Italian defense contractor Larimart S.P.A. appeared on the leak site of the crypto24 ransomware group. The attackers claim to have exfiltrated 2TB of internal files, including NATO-linked armor specifications, ballistic protection designs, export control documents, and confidential customer lists. While the total number of individuals whose personal data may be exposed remains unknown, anyone whose information appears in those records — employees, suppliers, partners, or their families — now faces heightened risk of identity theft and doxxing.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Larimart S.P.A
Get alerted the next time Larimart S.P.A files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Larimart S.P.A’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting on the ransomware.live portal states that crypto24 published a listing for Larimart S.P.A. on 15 July 2025. The group asserts it obtained 2TB of confidential material during a ransomware incident. Listed data categories include NATO-linked armor specifications, ballistic protection designs, EUC/EUS certificates, UAMA export control documents, VTLM test data from Santa Severa, strategic planning files, internal pricing information, Ministry of Defence invoices, tactical customer lists, and archives of consortium contracts and weapon-system development records. No independent verification of the exact volume or completeness of the leak has been published, but the presence of the listing on a monitored ransomware site is widely accepted as confirmation that negotiations failed and the data was released.
Why This Matters for You and Your Family
When a defense contractor loses control of internal documents, the fallout rarely stops at corporate secrets. Customer lists, invoices, and contract archives frequently contain names, addresses, phone numbers, email accounts, and payment details of private individuals and smaller suppliers. If your name, your spouse’s details, or your children’s information is in those files, it can surface on dark-web markets within days. Once that happens, the same credentials or personal identifiers are often reused against everyday accounts — banks, email, social media, and gaming platforms. For ordinary families this means sudden spikes in phishing calls, identity-theft attempts, or strangers showing up at your doorstep because an address was linked to sensitive work.
The Doxxing and Identity-Chain Implications
Credential leaks of this type rarely remain isolated. A single exposed email or phone number becomes the starting point for an identity chain that can reveal your full digital footprint. Attackers cross-reference the leaked data with information from earlier breaches, public records, and social-media handles. In hours they can map your username on one service to your child’s gaming account on another, then use that access to harvest more personal details or demand payment to stay silent. Public reporting indicates that ransomware groups increasingly sell or publish these chains to amplify pressure on both the primary victim and any connected individuals. The result is a cascading risk that extends far beyond the original 2TB dump.