Attack alert: inc ransom targets www.labiennale.org - IT

Introduction

The Venetian cultural organization La Biennale faced a cyberattack claimed by the inc ransom group on December 9, 2025. This historic institution, founded in 1895 and responsible for managing major international art exhibitions, saw its systems compromised, reaching SIGNAL alert level according to our XC classification. The incident affected a team of 50 to 100 employees, potentially exposing sensitive data related to artworks, collectors, and financial transactions. This attack illustrates the growing vulnerability of the Arts and Culture sector in Italy to ransomware.

The inc ransom cybercriminal group targeted www.labiennale.org, confirming the trend of malicious actors attacking cultural institutions. The compromise occurred at a time when Italian art organizations are accumulating highly valuable data: catalogs of artworks, information on private collectors, transaction details, and exhibition contracts. Analysis of this cyberattack reveals the specific challenges faced by cultural institutions, which are often less prepared than other sectors for modern digital threats.

Analyse détaillée

The Venice Biennale, a victim of this intrusion, is one of the world's most prestigious cultural institutions. With 130 years of history, it organizes major artistic events that attract international collectors, gallery owners, and art enthusiasts. The compromise of its IT systems raises critical questions about data protection in the Italian cultural sector, which is particularly vulnerable to targeted cyberattacks.

Inc ransom: modus operandi, history, and victims of the ransomware group

Inc ransom is an active ransomware group specializing in double extortion attacks, combining system encryption and the exfiltration of sensitive data. This cybercriminal collective threatens to publish the stolen information if the ransom is not paid, thus maximizing the pressure on its victims. Their tactic relies on identifying targets with critical data whose disclosure would cause significant reputational and financial damage.

Inc ransom's modus operandi follows a classic pattern of gradual intrusion. Attackers typically exploit vulnerabilities in exposed systems, compromised credentials, or targeted phishing campaigns to gain initial access. Once inside, they establish persistence within the network, perform in-depth reconnaissance of digital assets, and identify high-value data before exfiltrating and encrypting it.

The malicious actor operates according to a structured business model, with public claims of responsibility on dedicated leak websites. This "name and shame" strategy aims to coerce victims into paying by publicly exposing their compromise. The group targets various industries, from SMEs to large organizations, without apparent sectoral discrimination, prioritizing the opportunity and value of the data rather than a specific industry.

Inc ransom's previous victims cover a diverse range of organizations across different countries and sectors. The collective has demonstrated its ability to compromise technology companies as well as administrative and cultural institutions. This diversification of targets reflects an opportunistic approach that seeks to maximize financial gains rather than specialize in a particular area, making any organization potentially vulnerable.

www.labiennale.org: Company Profile Arts and Culture (50-100 employees) - IT

The Venice Biennale, accessible via www.labiennale.org, is one of the oldest and most prestigious cultural institutions in the world, established in 1895. This Italian organization manages international exhibitions of contemporary art, architecture, film, dance, music, and theater, attracting hundreds of thousands of visitors and art professionals each year. Its global reach makes it a key player in the international cultural landscape.

The organization employs between 50 and 100 people, primarily based in Venice, coordinating large-scale international events. It manages highly sensitive data, including information on exhibited artworks, their owners and collectors, financial transactions related to acquisitions and loans, and contracts with artists, gallery owners, and sponsors. This information represents considerable value, both commercially and confidentially.

Located in Italy, the Biennale operates within a strict European regulatory framework regarding the protection of personal data. The institution handles information concerning public figures in the art world, wealthy private collectors, and high-value financial transactions. A breach of this data could expose sensitive details about the art market, private collections, and confidential business relationships established over more than a century of activity.

The unique position of www.labiennale.org within the global cultural ecosystem amplifies the potential impact of this cyberattack. Beyond operational data, the organization likely holds digitized historical archives, correspondence with renowned artists, and strategic information on art market trends. This wealth of information makes the institution an attractive target for cybercriminals seeking to monetize unique and difficult-to-replace data.

Technical Analysis: Exposure Level

The attack against www.labiennale.org has been classified as SIGNAL according to our XC-Classify system, indicating early detection of the incident with limited data on the exact extent of the compromise. This alert level means that the intrusion has been identified and claimed by inc ransom, but a full analysis of the exposed data is underway. The SIGNAL classification represents the initial stage of our assessment scale, preceding the MINIMAL, PARTIAL, and FULL levels, which quantify the extent of the exfiltration.

The precise nature of the compromised files remains to be determined at the time of publication of this analysis. However, given La Biennale's profile, the potentially exposed data likely includes artwork catalogs, information on collectors and gallery owners, exhibition contracts, financial details of transactions, and business correspondence. This sensitive information, if disclosed, could compromise the confidentiality of business relationships and expose strategic details about the international art market.

The initial attack vector used by inc ransom has not been publicly confirmed at this stage. Compromises against cultural organizations typically result from the exploitation of vulnerabilities in exposed web systems, phishing campaigns targeting administrative staff, or the use of compromised credentials. The relatively small size of La Biennale's IT team (50-100 employees in total) may have limited the resources available for enterprise-grade cybersecurity, creating opportunities for intrusion.

The incident timeline indicates a discovery on December 9, 2025, likely corresponding to the publication of the ransom claim on the inc ransom leak site. The intrusion itself likely occurred several days or weeks prior, during which time the attackers were able to explore the network, identify valuable data, and exfiltrate it. This silent reconnaissance phase is characteristic of modern ransomware operations designed to maximize impact and pressure on the victim.

The risks associated with this data exposure are numerous for www.labiennale.org. Beyond the immediate reputational damage, the disclosure of information about private collectors could violate confidentiality agreements and expose the organization to legal action. The financial details of the transactions could reveal sensitive business strategies and affect future negotiations. The compromise of professional correspondence risks damaging relationships with international artists, gallery owners, and sponsors who trust in the institution's discretion.

Impact on the Arts and Culture Sector: IT Risks and Regulations

Conclusion

The Arts and Culture sector in Italy faces specific cybersecurity risks that are often underestimated. Cultural institutions accumulate highly valuable data on artworks, their owners, transactions, and exhibition strategies, while generally operating with limited IT budgets. This combination creates an attractive attack surface for ransomware groups seeking vulnerable targets with monetizable data. The attack against the Biennale illustrates this structural vulnerability of the Italian cultural sector.