Cattani

About the organisation

Established in 1967, Cattani S.p.A. is now a leader in the dental field, exporting its range of products to all continents. After becoming a publicly limited company in 1981, Cattani S.p.A. founded the division Esam in 1984, extending the group’s business activities into the industrial field. In 2003 Cattani S.p.A. launched Magnolia, a chemical company specialising in the production of detergent disinfectant products for surgery instruments and, in particular, dental aspiration systems.The Cattani group designed and manufactured one of the scientific components in the famous NASA space shuttle. Due to our reputation for reliability, Ferrari Engineering (supplier of the European Space Agency) chose us as one of its prestigious suppliers for the production of a 180 gram compressor, which reached a pressure of 38 bar. The group has also taken part in the Eurostar project, the pride of the Italian railway system, producing the train’s pressurization system.-Personal information of employees and clients -Financial documents- 200 000 + other files  https://www.***.it/en/

What the listing means

Cattani appeared on the spacebears leak site on 10 June 2026. Groups publish a victim once negotiations stall or as pressure during them, so a listing usually means data was already exfiltrated — the attack itself is dated 18 May 2026, 23 days before the listing. This group has published 7 claims in the last 30 days and remains active.

Recommended actions

• Treat any unsolicited message referencing Cattani as suspicious — leaked data gets weaponised for phishing within days.
• If you hold an account on www.cattani.it/en, change that password now, update it anywhere you reused it, and enable two-factor authentication.
• Watch for follow-on extortion: stolen data is often re-leaked or resold after the initial listing.
• A leak-site listing is a claim made by the attacker, not a confirmed breach — check the organisation's own disclosures before acting on it.

Leak-site evidence

Listing URL https://www.ransomware.live/id/Q2F0dGFuaUBzcGFjZWJlYXJz

Show leak-site screenshot

Captured from the group's extortion site. It may contain the victim's data or the attacker's messaging.