Alma Center Ransomware Claim by spacebears (Oct 2026)

Claim Summary

On or around October 15, 2026, a ransomware group calling itself “spacebears” allegedly listed Alma Center Servizi Medicali S.r.l. on its dark web leak site. According to the threat actor’s post, the victim is a private multi-specialty diagnostic and outpatient medical center based in Mariglianella, in the province of Naples, Campania, Italy. The group claims the facility was founded in 1984 by Dr. Emanuele Aliperti and operates as a polispecialistico center offering diagnostic imaging, laboratory, and specialist services under both private and SSN (National Health Service) agreements.

The claimed data volume is undisclosed. No sample files, screenshots, or proof-of-compromise artifacts have been independently reviewed by Yazoul Security. This listing remains an unverified assertion by the threat actor and should be treated as such until the organization or its regulators confirm otherwise.

Threat Actor Profile

The group operating as spacebears is not well documented in public threat intelligence. At the time of writing, there is no established track record, no confirmed victim count, and no publicly attributed toolset tied to this moniker. This is significant: newly emerged or rebranded groups frequently reuse leaked builder kits, purchased access, or affiliate programs from more established ransomware operations.

Because no known tools or tactics have been publicly documented for spacebears, defenders should not assume a specific malware family or exfiltration method. The absence of research references means credibility cannot be assessed from historical behavior. Groups with no verifiable history sometimes post inflated or recycled claims to build notoriety, and some listings are later removed without explanation. Until corroborating evidence emerges, the claim should be treated as low-confidence.

Alleged Data Exposure

The leak site post does not specify a data volume, file count, or data categories. The actor references the organization’s public website and describes its service profile, which is information available from public sources and does not by itself constitute proof of intrusion.

No protected health information, patient records, credentials, or internal documents have been verified as exposed. Healthcare providers in Italy process sensitive personal and health data under GDPR and national rules, making any genuine breach serious. However, at this stage there is no confirmed evidence that any data was accessed, exfiltrated, or published. We will not reproduce or link to any leaked material.

Potential Impact

If the claim is accurate, a healthcare diagnostic center could face operational disruption to imaging, laboratory, and outpatient scheduling systems, plus regulatory scrutiny under GDPR and Italian data protection authorities. Patient trust and referral relationships with the SSN could be affected. Secondary risks include phishing and fraud targeting patients if personal data were involved.

If the claim is false or exaggerated, the primary harm is reputational and operational distraction. Ransomware groups routinely overstate access to pressure victims into paying. Neither scenario should be assumed without verification.

What to Watch For

• Official statements from Alma Center Servizi Medicali or its parent entities.
• Notifications from the Garante per la protezione dei dati personali (Italian DPA).
• Any ACN (Agenzia per la Cybersicurezza Nazionale) advisories.
• Changes to the leak site listing, including countdown timers or removal.
• Corroborating reports from incident response firms or local media.

Organizations in the Italian healthcare sector should review backup integrity, segment clinical networks, enforce MFA on remote access, and monitor for unusual data staging or outbound transfers. Detection guidance specific to spacebears is not currently available; generic ransomware detection - anomalous encryption behavior, shadow copy deletion, and mass file renaming - remains applicable.

Disclaimer

This report is based solely on an unverified claim published by a ransomware group on its leak site. Yazoul Security has NOT independently confirmed the intrusion, the data exposure, or the accuracy of any detail in the actor’s post. The listing may be exaggerated, inaccurate, or fabricated. Nothing here should be read as confirmation that Alma Center Servizi Medicali S.r.l. suffered a breach. We publish this for situational awareness only and will update if credible corroboration emerges.