Blacknevas claims data breach at Quality Data Service, Inc.

• Ransomware group: Blacknevas
• Country: United States
• Sector: Technology
• Announcement date: August 6, 2025

The threat actor known as Blacknevas has announced a significant data breach involving Quality Data Service, Inc. According to a post on a ransomware leak site, the group claims to have exfiltrated approximately 300 GB of data from the organization's infrastructure. The announcement, made on August 6, 2025, suggests that the initial attack may have occurred as early as May 21, 2025.

Details of the alleged attack

The Blacknevas group has declared that they successfully exfiltrated data from the infrastructure belonging to Quality Data Service, Inc. In their announcement, the threat actors stated that they attempted to establish contact with the organization to discuss the matter, but they claim to have received no response from the company.

Following the alleged exfiltration, the group has declared that they are offering the stolen data for sale. Rather than a traditional direct ransom negotiation, the group has indicated that the alleged stolen data will be offered via an auction format. This method of operation is common in modern ransomware extortion, where attackers use public leak sites to pressure victims by creating a sense of urgency and public exposure.

Claimed stolen data

The threat actor has provided a list of the types of information they claim to have stolen during the breach. The data allegedly includes a wide range of sensitive files and databases, including:

• SQL databases
• Municipal records
• Tax department data
• GIS records
• User credentials
• Financial data
• Personal data
• Internal emails
• Software source code

The breadth of this alleged data set suggests a deep penetration into the organization's internal systems, potentially touching upon both administrative and technical layers of the infrastructure.

About Quality Data Service, Inc.

Quality Data Service, Inc. (QDS) is a technology company that provides tax assessment, property management, and administrative software solutions for municipalities in Connecticut. The company develops software that helps local governments digitize their operational processes, serving as a critical component in the digital infrastructure of local governance.

Risk assessment and implications

This breach may increase the risk of identity theft and fraud for the affected municipalities and citizens. Because the organization serves as a software provider for municipalities, this incident may pose a supply chain risk, where a compromise of a vendor can lead to downstream vulnerabilities for their clients. Given the sensitivity of the data involved, the affected entities may face obligations under GDPR or state-level data protection regulations.

Furthermore, the exposure of employees' personal information may facilitate targeted phishing attacks against the organization. Information regarding the Blacknevas group remains limited, making it difficult to attribute the attack to a specific known entity or to predict their long-term motives beyond the stated auction.

In general, when organizations face such threats, common defensive steps include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security audits. For software providers, ensuring secure development lifecycles and rigorous supply chain security measures is essential to mitigate the risk of downstream impact on municipal clients.