Gruppo C.R S.p.a
bd_4c2e6da58d81ff5f · schema v1 · pii pii-v1
Full breach record for Gruppo C.R S.p.a →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Sarcoma on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Gruppo C.R S.p.a In addition to the main activity represented by the large-scale retail sector, the company, always animated by the great spirit of initiative of its President, over the years has entered other commercial sectors, such as catering and fitness, and in recent times has also organized itself with a real technical structure, ready to study the identification of new solutions both technological and commercial and innovative for the realization of new outlets The large-scale retail sector is specifically characterized by 13 supermarkets under the Conad brand with reference to the food sector, and 1 store under the Upim brand with regard to the non-food sector, and also 2 pet stores under the Pet Store Conad brand. To complete the Group's business proposition, a new Cookery brand was created in 2016 on the occasion of the new opening of the Domus shopping center. To date, the GroupCr has 8 stores under the Cookery brand. Established for our in-house café/diner in the mall, it has since become a full-fledged production center. In this laboratory, bakery, pastry, dairy and kitchen products are prepared daily, with a distribution network for all our supermarkets. I n addition, since 2016 the company has decided to create together with other experts in the field, a craft beer production company, which is marketed with direct supplies to several highly specialized catering establishments in Italy and Europe.Geo: Italy - Leak size: 255 GB Archive - Contains: Files, SQL
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Apr 8, 2025
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
sarcoma
According to ransomware.live, Sarcoma is a ransomware group that debuted in October 2024, immediately ranking among the top three most active groups globally and surpassing 116 documented victims by mid-2025, targeting mid-market companies across manufacturing, retail, healthcare, legal, and business services with roughly 50% of victims in the United States.