Blacknevas claims data breach at Yateem Group

• Ransomware group: Blacknevas
• Country: Bahrain
• Sector: Retail & E-Commerce
• Announcement date: October 29, 2025

Blacknevas claims massive data leak against Yateem Group

The threat actor known as Blacknevas has announced a significant data breach involving the Bahrain-based Yateem Group. According to an announcement posted on a leak site on October 29, 2025, the group claims to have exfiltrated a vast amount of sensitive information belonging to the organization. The group alleges that the initial access was obtained through the IT departments of third-party entities, specifically Trojan Construction & Holding Group and T. Choithram And Sons, LLC, suggesting a potential supply chain compromise.

Details of the alleged compromise and claims

The Blacknevas group states that they have successfully compromised data belonging to Yateem Group and has indicated that the organization has ceased negotiations. Following the cessation of these discussions, the threat actor has stated they are preparing to publish a massive cache of stolen information. This cache is claimed to include over 100,000 files and databases that allegedly contain more than 9 million customer records. The total volume of the claimed data leak is estimated at 500 GB.

While the specific timing of the initial intrusion is cited by the group as April 24, 2023, the public announcement regarding the data leak was made much later. Ransomware groups often employ a double extortion tactic, where they not only encrypt an organization's internal systems but also steal sensitive data to use as leverage. By threatening to publish this data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

The scope of the stolen data

The information allegedly stolen by Blacknevas is highly sensitive, encompassing both corporate and personal details. Based on the screenshots provided by the attackers, which include samples of customer databases and personal identification documents, the following types of data are reportedly involved:

• Customer contact information (phones, emails)
• Employee passport copies
• Work contracts
• Insurance documents

About Yateem Group

Yateem Group is a well-established family-owned conglomerate operating across the Middle East. The group is primarily known for its extensive chain of optical retail outlets. In addition to its core optical business, the group manages various other brands and commercial facilities across the region.

Risk assessment and industry implications

This incident poses a high risk of identity theft and targeted phishing for both employees and customers of the organization. The exposure of highly sensitive documents, such as passports and employment contracts, could severely compromise the privacy of the individuals involved. Such a breach may also trigger legal proceedings under regional data protection regulations, as organizations are often held accountable for the security of the personal data they process.

The claim that access was gained through the IT departments of other companies highlights a growing security risk: the supply chain attack. In these scenarios, attackers target a vendor or partner with weaker security to gain access to a larger, more valuable target. This method demonstrates that an organization's security posture is heavily dependent on the security practices of its entire network of suppliers and service providers.

For organizations operating in the retail and e-commerce sectors, protecting customer and employee data is a critical priority. Common defensive steps to mitigate these risks include implementing strict third-party risk management programs, enforcing multi-factor authentication (MFA) across all access points, and maintaining robust encryption for sensitive data at rest and in transit. Because the organization has reportedly ended negotiations, the likelihood of the data being fully published on the leak site remains elevated.