ATD-American listed on Blacklock ransomware leak site

• Ransomware group: Blacklock
• Country: United States
• Sector: Professional Services
• Announcement date: May 16, 2025

The Blacklock ransomware group has issued a public announcement claiming that data belonging to ATD-American has been published on their leak site. This claim follows a period of time between the alleged incident and the public disclosure, marking a significant development in the group's activities against the organization.

Details of the claim

The threat actor known as Blacklock has officially listed ATD-American on their dedicated leak site. According to the announcement posted on May 16, 2025, the group cites November 18, 2024, as the date the incident occurred. This significant gap between the claimed attack date and the public announcement is a common occurrence in ransomware operations.

In an effort to facilitate communication with the target organization, the group has shared a specific communication channel via the Session messaging application. Ransomware groups often utilize encrypted or decentralized messaging platforms to conduct negotiations or issue ultimatums during double extortion campaigns. In such scenarios, the attackers typically threaten to release sensitive information if a ransom is not paid, leveraging the pressure of public exposure to coerce the victim.

Data involved in the incident

Regarding the specific contents of the alleged breach, no specific details regarding the nature of the leaked data have been provided by the threat actor. The listing names no specific data types or categories involved in the claim.

About ATD-American

ATD-American is a supplier of uniforms, personal protective equipment, and various textile products. The company serves a diverse client base, including government agencies, the military, and the private sector. Furthermore, the organization specializes in providing logistics solutions specifically tailored for the public safety and the defense industry.

Risk assessment and implications

This incident suggests that the institution's digital assets may be at risk of unauthorized access. Should the data be published, secondary risks could emerge, such as identity theft or targeted phishing attacks directed against employees and customers of the organization. Such secondary attacks often follow a primary breach, as stolen credentials or personal information can be used to gain further access or to deceive individuals within the supply chain.

Since the organization is based in the United States, potential data breaches of this nature may trigger legal processes under state-level data protection laws and regulations. Organizations operating in critical sectors, such as defense and public safety logistics, must remain vigilant as a breach can impact broader supply chain security. Because public information about the Blacklock group is limited, their specific methods and tactics have not yet been fully analyzed by the security community.

In general, when organizations face such threats, defensive strategies often include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular employee training to recognize phishing attempts. As ransomware groups continue to evolve, the ability to detect unauthorized access early remains a critical component of a comprehensive cybersecurity posture.