DiaSorin’s Ransomware Claim Exposes a Dangerous Information Vacuum -By Fransiscus Nanga Roka

An ad a cybercriminal puts up on the dark-web is not evidence that a company has been hacked. Corporate silence, however, is not evidence of safety.

The Settra ransomware group on September 3, 2026 published a listing for int. diasorin. In November 2020, the hacking group wrote on a DiaSorin domain it owned that faced internal users only: leak. DiaSorin is a diagnostic company based in Italy that creates technologies employed in various international healthcare markets. But as of September 4, the incident was still publicly designated “claimed”: there had been no public company statement or regulatory finding confirming encryption, proven data exfiltration, proven operational disruption or confirmed patient record theft.

That uncertainty should drive the narrative, not fade beneath tabloid headlines.

According to reports, Settra appeared in June 2026 and employs a double-extortion model that combines data theft with system encryption. It claims it will publish stolen files via a Tor-based leak site, the encrypted Tox protocol is used for negotiations. Threat analysts consider it an active group, but the number of victims it claims to have is only partially verifiable.

Questions remain over who attacked DiaSorin, how access was gained (was it a phishing attack?), which systems were accessed, what information was copied and whether any hospital partners face exposure. Attribution to “Settra” might identify only a criminal brand; ransomware operations often depend on affiliates with different identities and methods.

Therefore the claims that medical files, clinical data or research formulas were stolen are plausible risks, not established facts. For example, in the compromised environment a medical-technology company may house employee, commercial, research regulatory and partner information even if it does not have identifiable patient records. If the goal of an attacker is to creat panic, details are important.

The market narrative needs to be corrected as well. DiaSorin shares did not crash on September 3rd, Borsa Italiana milled +0.50% to about €76.76 closing price; On September 4 the stock opened trading down but so far, no evidence has linked the allegation of ransomware directly to that fall.

In a separate index-rebalancing decision, DiaSorin will be removed from the FTSE MIB (effective September 21) and replaced by Technoprobe. While it can cause mechanical selling from index-tracking funds, it should never be falsely misrepresented as a punishment for an unproven cyberattack.

What then is the significance if this episode anyway? Because diagnostics occupy a moment where healthcare, ip and transnational data flows intersect, in the most perilous of manners. Assay-Development research, regulatory submissions, manufacturing systems, employee information or contractual data exchanged with laboratories and hospitals are at risk if an intrusion is confirmed. Stolen credentials could be used to attack connected partners even without triggering immediate clinical disruption.

DiaSorin should not pay just on the basis of a criminal promise of deletion that cannot be audited. It can instead indicate whether a claim is genuine or not, when the unauthorized activity was initiated, whether systems or data were encrypted, which jurisdictions and data subjects have been affected, and if production of diagnostics has been impacted or product safety has been compromised.

Among them, the company must retain forensic images, replace privileged credentials, restrict suppliers’ access and conduct persistence hunting across entires land and cloud environments as well an independent probe. Particularly impacted hospitals, labs, staff and research collaborators need individual risk-based notifications not blanket assurances.

In Italy, national cybersecurity agency, a govet body coordinating between all other departments sec. privacy regulator; financial-market regulator; police and investigations to be coordinated with Kepe in bigger picture. They need to evaluate responsibilities under the GDPR, NIS2 framework and market disclosure rules while preserving evidence for prosecution.

Last but not least, significant mass market network segmentation is needed by European medical-technology companies; as well ensure recovery testing offline is tested, and both software-bill-of-materials controls_engineered into the product line and breach reporting contractual agreements across suppliers.

Settra is either bluffing, being partly honest alone or possesses catastrophic evidence. So those options should not be forced upon the public. Transparency is not reputational surrender in healthcare cybersecurity, it is patient safety.

Fransiscus Nanga Roka

Faculty of Law University 17 August 1945 Surabaya and Managing Partner Law Firm Victorious Indonesia