The Nightspire ransomware group has listed two more organisations as victims on its leak site, according to threat intelligence reports published on 7 November 2026. The two claims, both recorded by the Ransomware.live tracker at 04:10 UTC, name IMD Group in Italy and Gestimed in Spain.

In the IMD Group listing, the group claims to have targeted financial records and employee data. The trackers give an estimated attack date of 14 October 2026. The reported volume of data allegedly taken is listed as zero gigabytes, which appears to mean no volume has been disclosed rather than that nothing was taken. No details have been published about the attack method or the systems involved.

The Gestimed listing carries even fewer details. Gestimed, based in Spain and operating in the healthcare sector, was given an estimated attack date of 25 October 2026, again with zero gigabytes of data reported and no information about how the group supposedly gained access.

Neither claim has been independently verified. Neither organisation has been reported as confirming a breach, and no stolen data has been independently examined. Threat researchers stress that appearing on a ransomware leak site does not by itself establish that an intrusion occurred, and the listings should be treated as allegations until evidence emerges.

The two listings form part of a busy day for Nightspire, which also claimed UK manufacturer Meller Group on 7 November, alleging a 500GB data theft. The group, which emerged in March 2025, has listed more than 360 victims and typically uses double extortion, stealing data before encrypting systems. Organisations should watch for confirmation from the named companies before treating any of these claims as established fact.

[Source: qpulse.quasarcybertech.com](https://qpulse.quasarcybertech.com/news/7969/nightspire-ransomware-group-claims-attack-on-imd-group) | [Source: undercodenews.com](https://undercodenews.com/nightspire-and-anubis-add-two-new-organizations-to-their-ransomware-victim-lists-video/)