CILI listed on blacknevas ransomware leak site

• Ransomware group: blacknevas
• Country: Lithuania
• Sector: Hospitality
• Announcement date: August 6, 2025

Blacknevas claims a data breach at CILI

The Lithuanian and Latvian-based restaurant chain CILI has been listed on the leak site associated with the blacknevas ransomware group. According to the announcement made on August 6, 2025, the threat actor group claims to have successfully compromised the organization's database files. The group alleges that they have obtained significant amounts of sensitive information belonging to the company.

The details regarding the blacknevas group itself remain limited in the public domain, as there is very little information available concerning their specific operations or background. The claim suggests that the breach occurred around July 2, 2025, though the specific details of the attack vector or the method of entry have not been disclosed in the public announcement.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information on public forums if a ransom is not paid. This tactic is designed to maximize pressure on the victim by threatening their reputation and legal standing through the exposure of private data.

Claimed data and file types

The announcement by blacknevas claims that the stolen dataset contains a wide variety of sensitive information. Based on the claims made by the threat actor, the compromised data includes various types of customer-related information. The following items are alleged to be part of the breach:

• Customer data
• Addresses
• Email addresses
• Mobile phone numbers
• Shopping history
• Bank card information

In addition to the list of data types, the group provided a screenshot as evidence of the theft. This screenshot displays a list of files that appear to be SQL Server database files, which supports the claim that the attackers targeted the organization's central databases to extract the information.

About CILI

CILI is a large restaurant chain operating within Lithuania and Latvia. The company specializes in the hospitality sector and operates various culinary concepts. Their business model consists of a diverse range of establishments, including pizza-focused restaurants, bistros, and cafes, serving a wide customer base across the two countries.

Impact and organizational risks

The potential compromise of such a diverse dataset poses significant risks to the affected individuals. The inclusion of bank card information and mobile phone numbers increases the risk of direct financial losses and identity theft for the customers involved. Furthermore, the exposure of contact details and shopping histories provides threat actors with valuable intelligence that can be used for secondary attacks, such as highly targeted phishing campaigns or social engineering attempts.

For an organization operating within Lithuania, such a breach carries substantial regulatory implications. The company may face significant obligations under the General Data Protection Regulation (GDPR) regarding the protection and handling of personal data. A failure to secure this information can lead to investigations by regulatory authorities and potential legal consequences.

Beyond the regulatory and financial risks, the publication of sensitive customer data can cause lasting damage to an organization's reputation. In the hospitality industry, where customer trust is a fundamental component of business operations, a data leak can lead to a loss of consumer confidence. To mitigate these risks, organizations in this sector typically focus on robust defensive measures, such as implementing strong encryption for data at rest and in transit, enforcing multi-factor authentication, and maintaining rigorous monitoring of database access to detect unauthorized activity early.