Astidental di Sabbione

is a leading Italian distributor with over 60 years of experience specializing in dental equipment, instruments, and dental laboratory supplies. The company provides comprehensive services, including dental office turnkey design, digital workflow

BREACH IMPACT REPORT

SUMMARY

We obtained the complete dataset from Astidental, an Italian dental equipment distributor and service provider. The archive contains tens of thousands of files spanning from 2020 through 2026, with the heaviest concentration in 2023-2026. The data was extracted from a single file server and includes the full scope of business operations: accounting, banking, payroll, client management, technical service records, and commercial activities.

The dataset covers multiple operational areas. Financial records include invoices, bank statements, balance sheets, and payment documentation. Employee files contain payroll data, contracts, and personal documentation. Healthcare-related materials include medical equipment documentation, diagnostic records, and DICOM medical imaging files. Commercial records span supplier agreements, pricing lists, and public administration tender submissions.

Dozens of named individuals are identified throughout the dataset, including employees, clients, and business contacts.

WHAT WE HAVE

Personal Data

The dataset contains extensive employee records. We have payroll files (cedolini), employment contracts, and documentation tracking hires and departures. Personal identification documents and tax certification forms are present. Employee expense records and company vehicle documentation, including traffic violations attributed to staff members, are included.

Client records span the full customer base. Invoices name individual practitioners and dental clinics. Bank statements and account extracts reference named clients with associated financial details. Agent commission records identify sales representatives and their client relationships.

Medical imaging files in DICOM format are present in the dataset, containing patient diagnostic data.

Financial Records

The financial documentation is comprehensive. We have:

Tens of thousands of invoices (fatture) issued to clients

Bank statements (estratti conto) from multiple banking relationships

Balance sheets and consolidated financial statements (bilanci)

VAT settlement records and tax documentation

Payment records and bank transfer documentation

Banking relationships documented in the dataset include accounts and financing arrangements. Leasing contract files contain anti-money laundering documentation, insurance certificates, and loan agreements for equipment financing.

CBI format banking files are present, containing Italian standard banking transaction data.

Healthcare & Medical Equipment

The dataset reflects Astidental's role in the dental equipment sector. We have:

Technical service records for medical equipment repairs

Equipment documentation including autoclaves, turbines, lasers, and diagnostic systems

Public administration tender submissions for healthcare equipment procurement

Documentation related to ASL (local health authority) contracts

Diagnostic records (diagnosi) and pharmacy-related documentation (farmac) are present. Equipment maintenance logs and safety certifications for medical devices are included.

Commercial & Procurement

Supplier pricing lists and promotional offers from manufacturers are in the dataset. We have documentation from multiple dental equipment suppliers including reserved pricing agreements and special promotional terms. Cost analysis spreadsheets (analisi_costi) detail internal pricing calculations.

Public administration tender documentation includes bid submissions, technical specifications, economic offers, and integrity pacts for government healthcare contracts. Several tender packages contain complete submission bundles with all required certifications and declarations.

Legal & Corporate

Corporate governance documentation is present. We have board of auditors (collegio sindacale) materials, legal acts (atto_), and official correspondence. Trademark registrations (marchi) and company certifications are included.

Tax settlement records and F24 payment receipts document tax compliance activities. DURC certificates (documenting regular social security contributions) for suppliers and the company itself are present.

The dataset has been fully catalogued and indexed.

WHO CAN RECEIVE THIS DATA

Regulators

The dataset contains personal data of employees and clients, including tax identification information, financial details, and in some cases medical imaging data. Under GDPR, the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) has jurisdiction. The presence of DICOM medical imaging files and diagnostic records introduces additional considerations for health data protection.

Tax documentation and employee records can be reported to relevant Italian authorities.

Individuals

Dozens of named individuals are identifiable in the dataset. Employees have payroll records, contracts, and personal documentation exposed. Clients named in invoices and account statements can be contacted directly. The medical imaging data potentially identifies patients.

Competitors

Supplier pricing agreements, promotional terms, and reserved discount structures are present. Cost analysis documentation reveals internal pricing methodology. Tender submissions for public administration contracts include economic offers and technical proposals. This information provides competitive intelligence on pricing strategies and public sector bidding approaches.

Media

The combination of healthcare data exposure, public administration tender documentation, and the scale of financial records creates a substantial story. Medical imaging data in the breach adds weight given the sensitivity of health information.

WHAT CAN HAPPEN

The dataset can be transmitted to the Garante per la Protezione dei Dati Personali for regulatory review

Individuals identified in the data can be notified directly of the exposure

Medical imaging files and diagnostic records can be published, exposing patient health information

Supplier pricing agreements and commercial terms can be shared with competitors

Tender submission details for public healthcare contracts can be disclosed, affecting future bidding processes

Employee payroll and personal data can be used for identity fraud or social engineering

Banking documentation can be leveraged for financial fraud targeting the company or its counterparties

The complete archive can be published on leak sites, where it will be indexed and remain accessible indefinitely

Once this data is released, other parties can independently exploit it. Fraud groups, identity thieves, competitors, and subsequent threat actors can access and use the information. The exposure is permanent.