The inner workings of the Italian environmental group S.E.M.P. have become an open book. Corporate information - ranging from bank accounts and contracts to personal data, lab test results, and plans for selling equipment - has fallen into the hands of cybercriminals. The leak amounts to 802 GB. For a business that relies on government contracts and trust in its environmental infrastructure, the consequences will be far more severe than the attack itself.

S.E.M.P. S.r.l. was founded in 1978 in Assago, initially engaged in waste transportation. In 2000, the company moved to Pero, and in 2005–2006, it built an industrial complex there for the treatment of industrial effluents and established its own laboratory. By 2010, the authorized processing capacity for special liquid waste had been increased from 36,000 to 45,000 metric tons per year. Later, a facility for washing contaminated soil was added.
Today, S.E.M.P. operates on a much broader scale. According to official data, the company holds permits allowing it to handle municipal, industrial, and hazardous waste, act as an intermediary, and carry out the remediation of contaminated sites.

The company’s history is closely tied to the Sommaruga family. La Nuova Spurpoz traces its origins to the Arnaldo Sommaruga company, founded in Milan in 1960. In 1982, La Nuova Spurpoz S.r.l. was established; the company explicitly cites Marco Sommaruga’s involvement as part of its history. A specialized group has formed around S.E.M.P.: S.E.M.P. - industrial processing, reclamation, transportation, and laboratory services; La Nuova Spurpoz - flushing, emergency response, transportation, pipeline cleaning, and operations involving tankers and mobile equipment; LABONI - recovery and processing of pitch, resins, oils, fats, and chemical products. The group itself states that LABONI has been part of the S.E.M.P. group since 2006.

Documented evidence of the company’s activities extends far beyond Milan. Public government sources reveal contracts awarded to S.E.M.P. or its affiliated entities in at least four Italian regions: Lombardy, Liguria, Emilia-Romagna, and Tuscany. Moreover, the company does not work exclusively with the private sector.

In Genoa, the company received contracts from AMIU for the removal and disposal of concentrate with a total value of over €1 million ($1.16 million). In Emilia-Romagna, the value of one of the major contracts reached several million euros. In Lombardy, S.E.M.P. and La Nuova Spurpoz worked with AMSA. One of the 2022 contracts with AMSA involved the handling of 6,000 metric tons of material and was valued at €343,800 ($400,400). In another major contract in 2024, S.E.M.P. acted as a representative for La Nuova Spurpoz; the contract was valued at approximately €2.30 million ($2.68 million).

The scale of the business is evident in the figures. S.E.M.P.’s revenue was €23.68 million ($27.56 million) in 2022, €18.88 million ($21.97 million) in 2023, and €28.90 million ($33.63 million) in 2024. Net income in 2024 reached €3.95 million ($4.60 million). In the internal management report for 2024, which is already available on the dark web, EBITDA was approximately €8.36 million ($9.73 million).

But now the financial figures are sure to take a hit. In August 2026, S.E.M.P. fell victim to a cyberattack and suffered a data breach. The data set contains not only current documents but also archived records: contracts, accounting records, banking data, employee information, technical documentation, laboratory analyses, and documents from affiliated companies, including LABONI.

One of the documents discovered is an internal SEMP report titled “PROSPETTO VENDITA CESPITI 2026.” It lists 27 pieces of equipment, including Caterpillar excavators, Merlo telescopic handlers, tractors, and other machinery. The original cost of this fleet was approximately €781,000 ($909,000). The net book value as of June 30, 2026, was €117,700 ($137,100). The planned sales value stated in the document is €600,000 ($698,500), and the estimated profit from the sale is €482,300 ($561,500). For a competitor, this is no longer just a promotional brochure. It is information about which assets the company considers surplus and how it values them. And there are many such documents - we’re talking about hundreds of thousands of files.

S.E.M.P. builds its public image around ISO 9001, ISO 14001, EMAS, security, environmental responsibility, and waste traceability. In the environmental sector, it’s standard practice to know exactly what’s inside a container. But digital security requires the same level of discipline. And that’s where the problem arose.

Leaks of personal information pose risks to employees. Leaks of bank details and contracts pose risks to financial security. The disclosure of technical documentation poses risks to industrial security and competition. And for a government customer, another question arises: Can a supplier be trusted unconditionally if a significant amount of its internal information has fallen into the hands of criminals?

S.E.M.P., which specializes in waste recycling, has now encountered the most unpleasant kind of secondary raw material: its own internal information that has fallen into the wrong hands. The company recycles waste. Its own information—not anymore. Hackers will now be the ones to “recycle” it.

DATE FOR ANALYSIS PROVIDED BY QILIN