Blacknevas claims data breach at Arkin Group

• Ransomware group: Blacknevas
• Country: Türkiye
• Sector: Professional Services
• Announcement date: June 30, 2026

The ransomware group known as Blacknevas has claimed responsibility for a cyberattack targeting Arkin Group. According to an announcement posted on a leak site on June 30, 2026, the attackers claim to have exfiltrated approximately 1.4 TB of data from the organization. This type of announcement is characteristic of double extortion tactics, where threat actors not only encrypt an organization's systems but also steal sensitive information to use as leverage for ransom demands.

The claimed attack and method

According to the claims made by Blacknevas, the breach occurred on June 30, 2026. The threat actors assert that they gained initial access to the Arkin Group network by compromising a specific employee account within the reservations department. Once inside the network, the attackers claim they were able to gradually escalate their privileges, allowing them to move deeper into the infrastructure.

The group further claims that they successfully bypassed network segmentation, a security measure intended to isolate different parts of a network to prevent lateral movement. By overcoming these defenses, the attackers state they were able to exfiltrate a massive dataset totaling 1.4 TB. Reports suggest that some of the information allegedly stolen has already begun to surface on underground forums and darknet marketplaces.

The alleged stolen data

The data allegedly exfiltrated by the attackers is extensive and covers various sensitive aspects of the organization's operations and client base. The information reportedly includes highly personal and financial details that could be used for various malicious purposes. The following types of data are claimed to have been leaked:

• Guest profiles
• Passport details
• Financial data
• CRM data
• Casino player records
• KYC/AML documents

The specific details mentioned in the claim include guest profiles, passport details, phone numbers, stay history, financial booking information, CRM system data, VIP client notes, casino player IDs, deposit amounts, visit frequency, chip exchange records, and KYC/AML compliance forms.

About Arkin Group

Arkin Group is a tourism group operating in Northern Cyprus, specializing in luxury hospitality and casino management. The organization owns and operates several prominent properties, including The Arkın Colony, The Arkın Iskele, and The Arkın Palm Beach.

Impact and industry implications

This incident may increase the risk of identity theft and targeted phishing for hotel and casino guests due to the exposure of personal and financial information. Furthermore, the leak of sensitive data belonging to VIP clients could lead to physical security threats and extortion attempts. The organization may potentially face reputational damage and international financial scrutiny due to failures in protecting customer data. Additionally, the incident may potentially trigger stricter financial monitoring processes for the gambling sector in the region.

In such scenarios, organizations in the hospitality and gaming sectors often face significant challenges. The exposure of Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance forms is particularly sensitive, as these documents are foundational to regulatory compliance and financial integrity. When such data is compromised, the fallout often extends beyond immediate digital recovery to long-term regulatory and legal scrutiny.

To defend against such threats, organizations typically focus on strengthening identity and access management (IAM) to prevent unauthorized access via compromised employee accounts. Implementing robust multi-factor authentication (MFA) and enforcing strict network segmentation are also critical defensive steps to prevent attackers from moving laterally through a network. Continuous monitoring of network traffic and implementing zero-trust architectures are common strategies used to detect and mitigate unauthorized data exfiltration attempts before they reach a critical scale.