PROMOSFERA S.R.l. Listed by blacknevas Ransomware Group

On May 19, 2025, the Italian marketing firm PROMOSFERA S.R.l. appeared on the leak site of the blacknevas ransomware group. Internal files containing passports, employee records, client documents, and promotional databases were allegedly exfiltrated. The exposed material includes hundreds of thousands of emails paired with full names and tens of thousands of records that also contain phone numbers.

Reported Details from Reporting

Public reporting indicates that blacknevas posted two large archives on GoFile, accessible via links that remained active at the time of initial publication. The data set consists of scanned identity documents, internal company files, and structured databases listing participants in promotional campaigns. No precise total victim count has been confirmed, but the volume of personal records suggests the breach touches employees, clients, and contest entrants across multiple campaigns. The group’s post explicitly invites partners and victims to negotiate for the data while offering to source additional specific records on request.

Why This Matters for You and Your Family

When a company that runs promotions and collects personal details suffers a breach, the information rarely stays inside corporate systems. Emails, full names, and phone numbers are the exact building blocks used to link your identity across services. If you or any member of your family entered a contest, signed up for a loyalty program, or provided documents to PROMOSFERA, those details can now be bought or traded on underground forums. Once combined with data from earlier breaches, attackers can target bank accounts, government services, or even your children’s school and gaming profiles.

The Doxxing and Identity-Chain Risks

Credential leaks of this type frequently cascade into full identity chains. A phone number tied to an email can unlock social-media recovery flows; a scanned passport can be used to create synthetic identities or to pressure victims into paying to prevent further exposure. Public reporting shows that participants in promotional databases are often re-targeted because their data tends to be fresh and verified. Gaming accounts belonging to children are especially vulnerable because parents frequently reuse the same email or phone number across family sign-ups, turning one corporate breach into multiple household compromises.

Blacknevas Track Record

Public reporting attributes blacknevas with emerging in late 2024 and focusing on mid-sized European companies. The group’s publicly known victims include other marketing agencies and firms handling customer databases. Their typical playbook begins with initial access through phishing or exploited remote desktop services, followed by exfiltration of internal shares and databases, then publication on their leak site with an extortion demand aimed at both the company and its clients. The group routinely offers the stolen data for sale to third parties and maintains an open “contacts” section inviting bulk-data buyers.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used on PROMOSFERA or related promotional sites anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same contact details.
• Let DoxxScan remediation specialists manage takedown requests across data brokers and leak sites on your behalf.

The incident underscores that a single marketing database breach can quietly expand into long-term exposure for you and your family. Starting with a DoxxScan gives you an accurate picture of your current footprint and brings in specialists who perform continuous monitoring across 13.1B+ breach records and 100+ platforms, apply AI-powered identity-chain mapping, and deliver hands-on remediation—including protection for children’s gaming accounts that frequently become the next link in doxxing chains. Source: blacknevas leak site (via ransomware.live)