ELCON MEGARAD S.p.A Data Breach

ELCON MEGARAD S.p.A, an Italian manufacturing company that specializes in high-voltage power electronics, radiation processing equipment, and industrial electron beam systems, was recently listed as a victim on the Titan ransomware group’s dark web portal. The publication date for this listing was August 20, 2026, and it was identified through SOCRadar’s Dark Web Monitoring service. ELCON MEGARAD provides services to industrial clients across various sectors, including food safety, materials science, and environmental processing. This incident marks another instance of Titan ransomware targeting an Italian manufacturer, highlighting a persistent campaign against this sector within Italy. In the 60 days preceding this listing, the Titan ransomware group claimed responsibility for nine other victims, with a significant concentration within Italian manufacturing and professional services sectors. The group has consistently focused its efforts on small-to-medium-sized Italian industrial companies, frequently listing multiple victims within short operational windows. Recent victims from the same Italian manufacturing cluster include Elbor S.p.A., CONDOR SPA, Termotecnica Industriale S.r.l., and POEMA S.r.l. ELCON MEGARAD’s specific industrial profile, which involves radiation processing and high-voltage applications, suggests that a ransomware attack could have consequences extending beyond typical data theft, potentially impacting industrial process safety systems.

An initial-access correlation performed by SOCRadar against its stealer-log telemetry yielded no exposure signals for the elconmegarad.com domain within the queried sample. It is important to note that the absence of stealer-log evidence does not definitively confirm that no compromise has occurred. Instead, it indicates that the specific sample queried did not surface domain-specific credentials within the monitored feed. Titan’s continued targeting of Italian manufacturers suggests the group might be employing access methods that do not typically generate standard stealer-log artifacts. These methods could include supply chain vectors, compromised shared IT service providers, or the exploitation of vulnerabilities in industrial remote access systems. The ongoing pattern of Titan ransomware listings targeting Italian manufacturers, particularly those in specialized industrial and power electronics sectors, warrants attention. Even in the absence of externally visible stealer-log signals, the consistent targeting indicates a potential for Titan to gain access to Italian industrial networks beyond individual victim organizations. Consequently, peer firms operating within this sector are advised to conduct thorough audits of their shared IT services, industrial remote-access systems, and the security posture of their vendor supply chains as priority defensive measures.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.