Pentadiet Data Breach
The 2026 Pentadiet data breach occurred in January 2026 when the customer and patient CRM database of New Penta S.r.l. / Pentadiet (pentadiet.it), a major Italian clinical nutrition and ketogenic dietary therapy enterprise, was compromised and published online.
Exposed Data Types
1 sensitive6- Health records
- Email addresses
- Names
- Phone numbers
- Physical addresses
- Government issued IDs
About This Breach
What information was affected in the Pentadiet incident?
The leaked CRM dataset (susl Pentadiet.json and Info.txt) incorporates comprehensive patient records alongside prescribing physicians and clinical representatives. The breach compromised records for 93,149 unique individuals, exposing:
- Personal & Identity Information: Full names, first and last names.
- Government Identifiers: Italian national tax identification numbers (Codice Fiscale).
- Contact Credentials: Canonical email addresses, direct mobile phone numbers, and landlines.
- Geographic Location: Cities, administrative provinces, and postal codes across Italy.
- Health and Clinical Metadata: Linked physician identifiers (doctor_id, codice_medico), medical liaison tags, and role classifications (isDoctor, isPatient).
How many accounts were affected?
Rigorous RFC canonical parsing and deduplication confirmed 93,149 unique valid email addresses.
Technical analysis and security risks
The structured JSON extract stems from the company's internal CRM synchronization layer linked with Arca ERP. Exposing clinical patient identities tied with mandatory national fiscal identifiers (Codice Fiscale) and direct phone lines presents extreme risks of medical identity theft, targeted extortion, and health privacy violations.
Recommended actions for affected users
Patients and physicians registered with Pentadiet should:
- Remain alert to fraudulent communications or unexpected medical billing claims citing their personal details.
- Monitor official tax and credit records for unauthorized activities utilizing their Codice Fiscale.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
