Blacknevas claims data breach against Cash and carry - COSAEN GRUP
The threat actor known as Blacknevas has listed data allegedly belonging to the Spanish food wholesaler Cash and carry - COSAEN GRUP on its leak site, claiming a volume of approximately 243 GB.
- Published
- 2 min read
- 2 min read
- Ransomware group: Blacknevas
- Country: Spain
- Sector: Retail & E-Commerce
- Announcement date: August 6, 2025
Blacknevas claims data breach against Cash and carry - COSAEN GRUP
The threat actor known as Blacknevas has listed data allegedly belonging to the Spanish food wholesaler Cash and carry - COSAEN GRUP on its leak site. The group claims to have obtained a significant volume of information, asserting that the dataset totals approximately 243 GB in size.
Details of the alleged attack
On August 6, 2025, the Blacknevas group published an announcement on its leak site, listing data they claim to have obtained from the networks of Cash and carry - COSAEN GRUP. According to the group's claims, the breach occurred around May 30, 2025. The actor asserts possession of a massive dataset consisting of 983,158 files, totaling 243 GB.
In an effort to substantiate these claims and prove the legitimacy of the stolen information, the group has offered to provide sample files to interested parties upon request. This tactic is a common feature of modern ransomware operations, where threat actors use proof-of-concept data to pressure victims or attract buyers on the dark web.
Data types involved in the claim
Based on the screenshots provided by the threat actor, the leaked information appears to include various sensitive business and personal records. The identified data types include:
- Internal email correspondence
- Supplier information
- Commercial return records
- Employee contact data
The visual evidence provided by the group suggests that the stolen data contains internal email communications, return records extracted from Microsoft Dynamics NAV, information regarding suppliers, and various commercial communications that were conducted through instant messaging applications.
About Cash and carry - COSAEN GRUP
Cosaen Grup SA is a Spanish company operating in the food sector. The organization possesses wholesale and retail warehouses that offer a wide range of food, beverage, fresh, and dry goods.
Potential impact and industry implications
This incident may result in significant operational disruptions and reputational damage for the organization and its supply chain partners. Given the entity's location in Spain, the breach may fall under the scope of the European Union's General Data Protection Regulation (GDPR). The exposure of employee and supplier details could increase the risk of identity theft or targeted phishing attacks against the affected individuals.
Public information regarding the Blacknevas group is limited; however, the group appears to be motivated by the potential sale of data or its use for competitive advantage. In such scenarios, organizations often face the challenge of managing both the technical recovery and the legal obligations associated with data privacy.
For organizations operating in the retail and food wholesale sectors, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee training to recognize phishing attempts. Furthermore, because these breaches can impact entire supply chains, maintaining rigorous vendor risk management protocols is essential to mitigate the cascading effects of a single point of failure within a distribution network.
The organization may need to fulfill data breach notification requirements and inform all affected parties accordingly to mitigate the risks posed by the leaked information.