Ransomware: dragonforce claims Tecfi SpA (IT) — Business Services

On June 16, 2026, a ransomware group known as Dragonforce publicly claimed responsibility for a cyberattack against Tecfi SpA, an Italian business services firm. The claim was published on the ransomware.live data leak site under the BREACH framework, indicating that sensitive data may have been exfiltrated and is at risk of exposure. This incident highlights ongoing threats to EU-based companies, particularly those in the business services sector, which often handle critical client data and supply chain operations.

Organizations in the business services sector across the EU, especially those with operations in Italy or serving Italian clients, should consider this a direct risk signal. Companies that manage outsourced functions, payroll, or IT support are prime targets due to their access to multiple client networks. The attack underscores the need for heightened vigilance among firms that process personal or commercially sensitive data under GDPR and other EU regulations.

Compliance teams should immediately verify whether their organization has any direct or indirect relationship with Tecfi SpA, and assess potential data exposure. They should also review and test incident response plans, ensure ransomware-specific backups are isolated and recoverable, and confirm that breach notification procedures are up to date. Finally, teams should monitor for any leaked data that may impact their own clients or partners, and prepare to notify supervisory authorities if required under GDPR’s 72-hour rule.