BlackSuit ransomware group lists zyloware.com on its leak site

• Ransomware group: BlackSuit
• Country: United States
• Sector: Professional Services
• Announcement date: October 25, 2024

BlackSuit claims data breach at zyloware.com

The eyewear manufacturer zyloware.com has been listed on the leak site of the BlackSuit ransomware group. On October 25, 2024, the threat actor known as BlackSuit announced that they had compromised the organization's data. This announcement, categorized as a data leak, includes the organization's contact details and various operational information.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites serve as a public gallery where stolen data is showcased to increase the visibility of the attack. In many cases, these groups employ double extortion tactics. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive information to threaten its public disclosure. By threatening to publish stolen data, attackers aim to maximize the pressure on the victim to comply with ransom demands.

Details of the alleged compromise

According to the claims made by the BlackSuit group, the attack occurred on October 25, 2024. While the group has asserted that they have successfully compromised the organization's data, they have not provided specific details regarding the exact content of the allegedly compromised files. The only information provided by the threat actor regarding the scope of the breach is the total volume of the data involved.

• Claimed data size: 127 GB

The listing does not specify the number of files involved in the breach, nor has any specific ransom demand been issued or disclosed in the announcement. The lack of specific information regarding the nature of the files is a common occurrence in initial leak site postings, where the primary goal is to confirm the breach and establish the scale of the theft.

About zyloware.com

Zyloware is a long-standing company within the optical industry. Founded in 1923, the organization has a significant history in the design and manufacture of fashion-forward eyewear. The company produces a diverse brand portfolio of glasses and sunglasses for both men and women, focusing on delivering style, comfort, and durability to its customers.

Analysis and industry implications

The BlackSuit group is considered to be a continuation of the Royal ransomware operations. The potential exposure of the organization's data may lead to secondary risks, such as the disclosure of employee and customer information. For a US-based entity like Zyloware, any potential data breach may be subject to state-level privacy laws and regulations, which govern how companies must handle and report the exposure of sensitive personal information.

The operational continuity of groups like BlackSuit has been subject to scrutiny; for instance, reported law enforcement intervention into the group's infrastructure in 2025 may have resulted in shifts in their operational methods. Despite such interventions, ransomware groups often adapt their tactics to maintain their activities.

For organizations operating within the professional services and manufacturing sectors, such threats highlight the necessity of robust cybersecurity frameworks. Common defensive steps that organizations can take to mitigate these risks include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees. Furthermore, monitoring for unauthorized data exfiltration and ensuring strict access controls can help reduce the likelihood of a successful double extortion attempt.