Mercatino S.r.l. https://www.mercatinousato.com Listed by RansomHub Ransomware Group

On June 11, 2024, Italian classifieds site Mercatino S.r.l. (mercatinousato.com) appeared on the RansomHub leak portal. The ransomware group claims to have exfiltrated 1.5 TB of the company’s internal files during a ransomware attack. The listing remains unpublished, meaning the data has not yet been made freely available for download, but the mere presence on the extortion site signals that negotiations have likely failed or are stalled.

Details in the RansomHub Listing

The primary disclosure on the RansomHub onion site states that Mercatino S.r.l. was compromised in a ransomware operation. It lists the victim’s name, website, visit count of 616, and the claimed volume of stolen material as 1.5 TB. The entry does not specify which exact records were taken, nor does it quantify the number of individuals whose information is contained in the files. The leak-site listing does not detail what was taken beyond describing the material as “internal files exfiltrated in ransomware attack.” No ransom demand figure or payment deadline is shown in the current entry.

Why This Matters for You and Your Family

When a company that hosts classified advertisements suffers a breach, the exposed internal files can contain personal details submitted by everyday users: names, email addresses, phone numbers, physical addresses, and sometimes copies of identity documents or payment records. If you or anyone in your household has bought or sold items on Mercatino, your information may now sit in a 1.5 TB archive controlled by extortionists. Even though the data has not been published, the threat of future release or private sale remains. Families are affected because one person’s account often links to shared household contact details, children’s names, or family photos attached to listings.

Doxxing and Identity-Chain Risks

Internal files from a classifieds platform frequently create long identity chains. An email address tied to a Mercatino account can be correlated with usernames on gaming platforms, social media, or shopping sites. Attackers stitch these together to build full profiles that include home addresses, phone numbers, and family relationships. Such chains fuel doxxing, targeted phishing, and account takeovers. Credential leaks of this kind routinely cascade into gaming account compromises; children’s profiles linked to a parent’s breached email become easy secondary targets. The longer the data sits with RansomHub, the higher the chance it will be used to map and harass real people rather than simply held for ransom.

RansomHub’s Known Track Record

Public reporting attributes RansomHub’s emergence to early 2024. The group has quickly built a reputation for double-extortion tactics: encrypting victim systems while simultaneously exfiltrating data for leverage. Notable prior victims include healthcare providers, manufacturing firms, and retail operations across Europe and North America. Their typical playbook begins with initial access gained through compromised credentials or exploited remote desktop services, followed by rapid lateral movement, data exfiltration, and then simultaneous encryption and public shaming on their leak site. When victims refuse payment, RansomHub often publishes samples or sells the archive to other threat actors. The group’s rapid rise and willingness to follow through on publication threats make any appearance on their portal a high-priority incident.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed records.
• Rotate any password you used on Mercatino anywhere else it is reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same breached details.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf.

The incident underscores that even mid-sized online marketplaces can become gateways to personal exposure for thousands of ordinary users. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chains they are building. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give families a practical way to stay ahead of these cascading risks. Start your DoxxScan trial today.