Applied LNG targeted by Blacknevas ransomware group

• Ransomware group: Blacknevas
• Country: United States
• Sector: Energy & Utilities
• Announcement date: January 8, 2026

Blacknevas claims to have stolen data from Applied LNG

The threat actor group known as Blacknevas has published data allegedly belonging to Applied LNG on their dedicated leak site. According to the announcement made on January 8, 2026, the group claims to have successfully executed a cyberattack against the organization on December 22, 2025. This incident involves a data leak, a common tactic used by modern ransomware operators to pressure victims into paying ransoms.

The group has listed various documents on their platform that purportedly belong to the company. The post includes a link to a file listing that allegedly contains documentation related to the operational processes of the organization. While the group has posted these claims, the specific volume of data and the exact number of files involved have not been disclosed by the attackers.

Details of the alleged data breach

The information shared by Blacknevas appears to target the core operational and financial documentation of the company. Based on the screenshots provided by the threat group, the leaked content includes sensitive business documents. These documents are said to cover several critical areas of the company's business activities, including logistics and financial management.

The specific types of data mentioned in the listing include:

• Commercial contracts
• Logistics data
• Financial statements

The exposure of such documents can have significant implications for the company's business relationships and internal operations.

About Applied LNG

Applied LNG is an energy company that provides liquefied natural gas (LNG) solutions, equipment financing, maintenance, and logistics services. Founded in 1995, the company specializes in the motor fuel market and power generation sectors.

Analysis and potential impact

This leak may lead to a loss of corporate reputation by exposing Applied LNG's commercial partnerships and operational processes. The shared financial data and contracts could create secondary risks for the company's supply chain partners and may facilitate targeted phishing attacks. As a US-based entity, legal processes could be triggered under state-level data protection regulations and potential privacy violations.

Information about this group is limited; however, their ransomware methods suggest they adopt a double-extortion strategy through data exfiltration. In a double-extortion scenario, attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive data to use as leverage. If the victim refuses to pay the ransom to unlock their systems, the attackers threaten to release the stolen information publicly, as seen in this case.

For organizations operating in the energy and utilities sector, such incidents highlight the importance of robust cybersecurity frameworks. Protecting sensitive commercial contracts and financial statements is vital to maintaining trust with partners and preventing secondary attacks. Organizations typically defend against such threats by implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to identify vulnerabilities in their supply chain and operational networks.