Mercatino https://www.mercatinousato.com Listed by ransomhub Ransomware Group

On June 11, 2024, Italian online marketplace MercatinoUsato.com appeared on the RansomHub leak site with 1.5 TB of claimed internal files exfiltrated during a ransomware attack. The listing remains unpublished, meaning the data has not yet been openly released, but the extortion group has placed the company on public display to pressure payment. Anyone who has bought or sold on the platform, or whose personal details sit in its databases, now faces the possibility that sensitive records are in criminal hands.

Primary Disclosure Details

The RansomHub leak page states that Mercatino was compromised in a ransomware operation and that attackers successfully exfiltrated 1.5 TB of internal files. The disclosure does not specify the exact data types taken, the number of affected individuals, or the systems accessed. It simply lists the company, the claimed volume, and a visit counter that stood at 87 when first indexed. The sample files or full archive have not been published as of the latest available information from the onion site. Public reporting on RansomHub indicates the group typically uses this initial listing phase to signal seriousness before escalating to data dumps if demands go unmet.

Why This Matters for You and Your Family

When a marketplace like Mercatino suffers a breach, the exposure often includes names, addresses, phone numbers, email accounts, payment details, and transaction histories of everyday users. Even though the precise records remain unknown, 1.5 TB of internal files is large enough to contain information on hundreds of thousands of Italian households. If your email or phone number was used to register an account, sell a used car, or buy second-hand goods, those details could now sit in an attacker’s archive. For families this creates overlapping risks: one parent’s data can expose children’s names and school-related messages, while shared addresses link every member to the same incident.

Doxxing and Identity-Chain Risks

Stolen marketplace data rarely stays isolated. Attackers and subsequent buyers routinely combine it with other leaks to build full identity profiles. An email from Mercatino can be cross-referenced with credential dumps, social-media handles, and gaming accounts, quickly turning a simple transaction record into a doxxing chain. Public reporting on similar incidents shows that once personal details surface on dark-web forums, they fuel SIM-swapping attempts, account takeovers, and targeted harassment. Credential leaks like this one cascade into account takeovers that can reach your children’s gaming profiles, where the same password or security questions may have been reused.

RansomHub’s Known Track Record

RansomHub emerged in early 2024 and has rapidly become one of the more active double-extortion operators. Public reporting attributes prior attacks to the group against organizations in healthcare, manufacturing, and retail sectors across North America and Europe. Their standard playbook involves initial access through compromised credentials or vulnerable remote desktop services, followed by exfiltration of sensitive files before encryption. The group then posts a victim listing on their leak site, waits for media attention, and escalates by publishing proof files or full datasets if the target refuses to pay. In Mercatino’s case the data remains unpublished, consistent with RansomHub’s pattern of using the threat of release as leverage.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you used on MercatinoUsato.com anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to the same credential chains.
• Let remediation specialists manage takedown requests for any exposed personal records that appear on data-broker or underground sites.

The incident underscores how quickly a single marketplace breach can ripple into long-term identity exposure for ordinary families. Acting promptly on credential hygiene and identity mapping limits the damage before attackers monetize the data further. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.