Galbusera Agricultural Company Data Breach

Galbusera Agricultural Company, an entity operating within the Agriculture and Food Production sector and based in Italy, has been identified as a victim on the dark web portal of the lockbit5 ransomware group. This listing, published on August 16, 2026, was detected by SOCRadar’s Dark Web Monitoring service. The company is now among an increasing number of organizations targeted by lockbit5, underscoring the group’s persistent and widespread operational activities across diverse industries and geographic locations. The nature of its business, potentially involving critical infrastructure and sensitive data related to food supply chains, could make it an attractive target for ransomware and extortion operations. In the 60 days preceding this listing, lockbit5 claimed 57 other victims. The group has predominantly targeted the Manufacturing, Business Services, and Hospitality sectors, with a significant concentration of victims in Germany, France, and Thailand. The inclusion of Galbusera Agricultural Company aligns with lockbit5’s established pattern of targeting organizations within the agriculture and food production industry. Similar to recent victims such as Sito Rete, Verbandsgemeinde Rhein-Nahe, TECOSIM, and dupouy-associes.fr, Galbusera Agricultural Company’s listing demonstrates lockbit5’s broad reach and consistent focus on vulnerable sectors.

SOCRadar’s analysis of infostealer-harvested credentials, querying the domain agricolagalbusera.it, returned no records within the examined scope. It is crucial to understand that a null result does not confirm the absence of compromise. The paginated sample reviewed may not encompass all relevant logs, and credentials could exist under alternate corporate domains or personal email aliases utilized by employees of Galbusera Agricultural Company. Therefore, CTI teams should not interpret this negative finding as definitive proof of the organization being unaffected. For ransomware operations like lockbit5, the exfiltration of credentials via infostealers is a recognized method for initial access. Threat actors or initial access brokers often source these credentials from underground marketplaces, validate them, and then use them to gain entry to systems such as Microsoft 365, VPNs, or remote-access portals, paving the way for ransomware deployment. The absence of observed credentials in this specific query does not preclude such a scenario. The data might exist in other, unqueried datasets, or the credentials may have been compromised and rotated before being indexed. The potential for credential compromise and its subsequent use for initial access remains a significant concern. It is recommended that CTI teams maintain vigilant monitoring of dark web and stealer-log feeds. Proactive measures such as credential hygiene checks, regular password rotation, and robust multi-factor authentication reviews for Microsoft 365, VPNs, and remote-access portals are essential. Continued monitoring of alternate corporate domains and personal email aliases may also be necessary to detect any further indicators of compromise.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.