PROMOSFERA S.r.l. promosfera.com Listed by Blacknevas Ransomware Group

On May 19, 2025, the Italian marketing firm PROMOSFERA S.r.l. appeared on the leak site of the ransomware group Blacknevas. The attackers published links to internal files containing passports, employee and client documents, promotional participant databases that include hundreds of thousands of emails and full names, and tens of thousands of records combining emails, full names, and phone numbers.

What Public Reporting Shows

Public reporting indicates the data was exfiltrated during a ransomware incident and later posted on the group’s dark-web publication page. Two GoFile links were provided: one at https://gofile.io/d/5gNeSz and another at https://gofile.io/d/dY7rYE. The sample files contain internal company documentation along with the personal records described above. The number of unique individuals affected remains unknown, but the volume of email addresses alone runs into the hundreds of thousands.

Blacknevas also posted a message inviting “partners, friends and clients” to contact them through known channels to purchase the data, while new buyers were told to wait for instructions in the Contacts tab. The group openly advertised willingness to provide specific data extracts on request.

Why This Matters for You and Your Family

If you or any member of your family ever participated in a PROMOSFERA-run promotion, contest, or marketing campaign, your name, email address, and possibly your phone number and passport details may now be circulating among criminals. Even if you were not a direct customer, employee data leaks can expose spouses or children listed as emergency contacts or beneficiaries.

Once names and emails are paired with phone numbers, the information becomes far more valuable for identity theft, phishing, and account takeover attempts. Criminals routinely test stolen credentials across banking, shopping, and social-media sites. A single leak like this can therefore place every reused password and every linked account at immediate risk.

The Doxxing and Identity-Chain Risk

Leaked promotional databases often contain not just contact details but also usernames, account handles, and references to children’s entries in family competitions or gaming promotions. These fragments allow attackers to map one piece of information to another, building a complete profile that links your email to your social-media accounts, your children’s gaming profiles, and your home address. What begins as a marketing-list breach can quickly escalate into full doxxing, harassment, or targeted extortion.

Credential leaks of this type frequently cascade into gaming-account takeovers. Children’s accounts tied to the same family email or phone number become easy secondary targets, exposing chat logs, payment methods, and further personal details that extend the identity chain.

Blacknevas Track Record

Public reporting attributes Blacknevas with emerging in late 2024 as a ransomware operation that combines data theft with extortion. The group has listed multiple companies on its leak site, typically following the same pattern: initial access through phishing or exploited remote-desktop services, exfiltration of sensitive files, followed by publication of samples when victims do not pay. Their public communications emphasize direct sales of stolen datasets to the highest bidder rather than broad public dumps, although they still publish enough material to pressure targets.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, then use the included cleanup of data-broker records.
• Rotate any password you ever used on promosfera.com or related promotional sites, and enable two-factor authentication through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your information is caught within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same family address or email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing accounts.

The PROMOSFERA breach is a reminder that marketing databases are now prime targets and that one exposed promotion entry can endanger every account tied to your name. Starting with a DoxxScan gives you both an immediate map of your exposure and ongoing protection through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Source: Blacknevas leak site via ransomware.live