Ransomware: krybit claims studiotibaldi.it (IT) — Professional Services

A new ransomware incident has been publicly disclosed, with the threat actor group Krybit claiming responsibility for an attack on studiotibaldi.it, an Italian website associated with the professional services sector. The claim was published on the ransomware.live data leak site on 9 August 2026, under the BREACH framework, which indicates that data exfiltration is alleged. The listing confirms the target but does not yet specify the volume or type of data compromised, nor whether a ransom deadline has been set.

The primary affected organization is Studio Tibaldi, an Italian professional services firm, likely providing legal, accounting, or consultancy services. However, the indirect impact extends to its clients, partners, and any third parties whose personal or financial data may be held by the firm. Given the sector, sensitive client information, contracts, and billing records are at high risk. Other professional services firms in the EU should treat this as a warning, as Krybit appears to be actively targeting this industry.

Compliance teams should immediately verify whether their organisation has any data-sharing relationship with Studio Tibaldi and assess exposure. For those in the professional services sector, review current ransomware defences, including offline backups, endpoint detection, and employee phishing awareness. If you are the affected entity, activate your incident response plan, notify your supervisory authority under GDPR within 72 hours if personal data is involved, and prepare customer notification letters. Monitor the ransomware.live page for updates on leaked data, and consider engaging forensic specialists to confirm the breach scope.