An emerging extortion crew calling itself xpl0itrs has listed Gruppo Spaggiari Parma, the Italian company behind the ClasseViva electronic gradebook, on its leak portal and claims to hold 6.1 TB of documents tied to more than 3,000 Italian schools. Ransomware.live logged the posting on 20 August 2026 at 19:31 UTC and recorded the exfiltration figure as 6,100 GB, while flagging that xpl0itrs is a new group whose claims should be treated with caution. Spaggiari published an official statement the following day confirming that an event occurred on 30 June 2026 but restricting its scope to a single component, the Modulistica Smart forms module of the Bergantini platform, and explicitly excluding the electronic register and its school and secretariat management software. The two accounts do not reconcile, and as of publication neither the actor's volume claim nor the company's containment claim has been independently verified.
What Happened
The intrusion itself predates the disclosure by nearly two months. Spaggiari's own communication, dated 21 August 2026 at 17:22, places the event on 30 June 2026 and states that the company notified the Garante per la protezione dei dati personali with a subsequent supplementary notification, reported to the Agenzia per la Cybersicurezza Nazionale, and filed a criminal complaint with judicial police that was also later supplemented. Forensic investigation is described as ongoing with outside legal and technical advisers.
Nothing surfaced publicly until 20 August, when the "Gruppo Spaggiari Parma" entry appeared on the xpl0itrs portal. Hackmanac and Dark Web Intelligence amplified the claim over the following days, and DigitalShield, Undercode News, DDay.it and Dark Web Informer all picked it up between 21 and 24 August. Pasquale Pillitteri's writeup frames the gap bluntly: the breach became public not because the company announced it, but because whoever took the data decided to monetise it.
The extortion track then escalated. DDay.it, writing on 22 August, reported a countdown with roughly five days remaining and a ransom demand of 55.1 million (the figure appears in euros in the Italian coverage). By 23 August, Dark Web Informer observed xpl0itrs offering the material for sale on a forum at an asking price of 50,000 dollars, with the actor stating it was publishing because negotiation with the company had failed. That collapse from an eight-figure extortion demand to a five-figure bulk sale inside about 24 hours is itself an indicator: it is the behaviour of an actor that failed to convert leverage and is now liquidating.
Coverage is inconsistent on one point worth pinning down. Undercode News published two pieces whose headlines read "61TB" and "61 TB," but both article bodies state 6.1 TB, matching every other source and the 6,100 GB figure on ransomware.live. Treat the 61 TB headline as a typographical artefact, not a competing measurement.
What Was Taken
Accounts differ sharply on scope, and the disagreement is the story.
The actor's position, as catalogued by Dark Web Informer, is a document dump rather than a structured database: thirteen enumerated document types including identity cards, driving licences, tax documents, codice fiscale records, ISEE income statements, diploma certificates, school report cards, medical certificates, paediatric medical files, prescriptions, vaccination records, and CVs and job applications, with two samples of each type published and further categories said to be unlisted. Undercode News reports the actor also claimed 12.8 million people affected, a figure no other source corroborates and which should not be treated as established. DDay.it adds teacher identifiers, student certifications and clinical records to the claimed inventory, and notes that at the time of its 22 August writeup no samples had yet been released that would allow verification. Dark Web Informer's 23 August post states samples were subsequently published openly, so the sample question appears to have moved between those two dates rather than the sources contradicting each other outright.
The company's position is narrower by an order of magnitude in kind, if not in stated volume: the affected perimeter is Modulistica Smart, used for compiling and submitting online forms and applications. Spaggiari states directly that its analyses exclude the register and the school and secretariat management systems, which it describes as a distinct and separate system, and that public reconstructions attributing the event to other platforms are not supported by its findings. The company also says services remained operational with no interruption and no compromise to the availability or integrity of data handled through its applications, and it reserves the right to protect its reputation and interests through the competent authorities.
Notably, a forms-and-applications module is not an implausible source for the exact document mix xpl0itrs advertises. Enrolment and application workflows are precisely where identity documents, ISEE declarations, medical certificates and vaccination records get uploaded. That does not validate the 6.1 TB figure, but it means the two accounts are not automatically mutually exclusive on data type, only on volume and blast radius.
DDay.it raises the sharpest sensitivity concern: platforms in this ecosystem potentially carry PDPs, the personalised education plans prepared for students with specific learning disorders or other special educational needs. Those are health-adjacent records about identifiable minors, a special category under GDPR Article 9, and they are the single worst category in any claimed inventory here.
Why It Matters
This is a supplier-concentration event. Spaggiari is not one school's vendor; it is a shared dependency across a large fraction of Italian schools, and Undercode News notes its own privacy documentation describes it operating as a data processor on behalf of educational institutions. When that tier is hit, thousands of individually compliant schools inherit a breach they had no ability to prevent and limited ability to investigate.
The victim population is the aggravating factor. Student records combine long-lived identifiers, family financial data and health information on subjects who are minors and who will not be monitoring their own credit or identity exposure for another decade. DigitalShield's framing is correct: stolen student data retains value to criminals for years, in a way that a dump of expiring payment cards does not.
The timing compounds it. The claim landed a few weeks before the start of the Italian school year, when registration, form submission and secretariat traffic peak, and when both parents and school offices are most likely to act on an urgent-sounding message about their child's records. Expect phishing that impersonates Spaggiari, ClasseViva or school administrators, whether or not any real dataset ever gets published.
One further signal, from ransomware.live's Hudson Rock enrichment: infostealer telemetry associated with the Spaggiari domain shows 6 compromised employees, 8 third-party employee credentials and 62,539 compromised users, against an external attack surface of 102. That is background credential exposure typical of a company this size, not evidence of the entry vector, but it is the kind of inventory that turns a single foothold into a wider one.
The Attack Technique
No confirmed vector exists. Spaggiari's statement describes the perimeter of the event and its regulatory response but does not disclose how the intrusion occurred. DDay.it reports the attacker's own claim that the group gained access after finding a vulnerability, which is an unverified assertion from the extortionist and nothing more. Dark Web Informer records the actor's stated source as direct compromise. Ransomware.live's entry lists an estimated attack date of 20 August, which reflects the posting date rather than the intrusion; the company's 30 June date is the better-supported one.
What the available evidence does support is a data-theft extortion model rather than encryption. No source reports ransomware deployment, no source reports service disruption, and the company affirmatively states availability and integrity were not affected. The pressure sequence, private negotiation, then leak-site listing, then countdown, then open sale after negotiation failed, is the standard exfiltration-only playbook now common among newer crews that lack a mature encryptor.
What Organizations Should Do
- Scope by module, not by vendor. If you are a Spaggiari customer, ask specifically whether your institution used Modulistica Smart on the Bergantini platform between and before 30 June 2026, and request the list of form submissions and attachments processed through it. The company's own boundary claim is the right axis for that question.
- Pull your processor notifications now. Under GDPR Article 28 and Article 33, schools acting as controllers need the processor's breach documentation in hand to assess their own notification duties. Spaggiari has filed with the Garante and ACN; request the corresponding customer-level detail rather than relying on press coverage.
- Treat special-category records as the priority triage. Medical certificates, vaccination records, prescriptions and any PDP or BES documentation for students with learning disorders carry the highest harm potential. Inventory where those were submitted electronically and flag affected families first if exposure is confirmed.
- Pre-position anti-phishing messaging to parents and staff. Publish, through your own established channel, a statement that you will never request document re-uploads, credentials or payment via email or SMS. Do this before the school year starts, not after the first fraudulent message circulates.
- Force credential hygiene across the ecosystem. Given the infostealer exposure visible in third-party telemetry, rotate administrative and secretariat credentials for school-facing platforms, enforce MFA on all staff accounts, and audit third-party and integrator access that touches student data.
- Log and monitor rather than assume containment. Until forensic conclusions are published, retain relevant access logs, watch for anomalous access to gradebook and secretariat systems, and monitor leak channels for sample publication that would let you verify affected record sets directly instead of arguing about terabytes.
Sources: Hackers claim massive data theft from thousands of students across... | Spaggiari Hacked, xpl0itrs Claims 6.1 TB From 3,000+ Italian School... | Italian EdTech Giant Gruppo Spaggiari Parma Allegedly Hit in Major... | 6.1 TB of Italian School Documents Offered for Sale as ... | 61 TB of Italian School Data Reportedly Offered for Sale, Raising F... | Comunicazione ufficiale su attacco informatico alla piattaforma Ber... | Gruppo Spaggiari, 6 TB di dati di studenti e docenti nelle mani deg... | Ransomware.live - Victim: Gruppo Spaggiari Parma