EVAS Group listed on Blacklock ransomware leak site

• Ransomware group: Blacklock
• Country: Philippines
• Sector: Transportation
• Announcement date: May 16, 2025

Blacklock claims data breach against EVAS Group

The threat actor known as Blacklock has listed EVAS Group on its leak site, alleging a significant data breach. According to an announcement made on May 16, 2025, the group claims to have successfully breached the organization's systems and acquired data. This development follows an alleged initial access date of January 10, 2025, though the specific details regarding the methods used to infiltrate the network have not been disclosed.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. By publishing the names of targeted organizations, these groups aim to damage the victim's reputation and coerce them into paying a ransom. In many modern cyberattacks, threat actors utilize a tactic known as double extortion. In this scenario, the attackers do not merely encrypt the victim's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. This allows them to threaten the public release of stolen information if the ransom demands are not met, significantly increasing the pressure on the targeted entity.

Details of the alleged incident

The Blacklock group's announcement regarding EVAS Group remains relatively sparse in terms of technical specifics. While the group asserts that it has gained access to the organization's systems and has acquired data, the announcement does not provide any specific information regarding a ransom demand. Furthermore, there is no information provided concerning the volume of the compromised data or the specific file count involved in the breach.

Regarding the nature of the information stolen, the listing names no specific data types. The only information provided in the group's public communication is a screenshot containing contact information for the threat group itself. There is no further information available regarding the specific content of the compromised or threatened data.

Organization profile

EVAS Air Charters is a Canadian aviation company that provides private aircraft charter services. These services are specifically tailored for corporate and business travelers. The company is known for offering customized flight schedules and high-quality in-flight services designed for its executive-class clients.

Potential implications and industry risks

This incident may lead to operational disruptions and reputational damage for the organization. Because EVAS Group is a Canada-based entity, a potential data breach could trigger legal processes under PIPEDA regulations. The exposure of sensitive data can create significant secondary risks for both employees and customers, including the threat of identity theft or the execution of targeted phishing attacks.

For organizations operating within the transportation and aviation sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Organizations in this sector often handle sensitive passenger information and complex logistics data, making them attractive targets for sophisticated threat actors. To mitigate these risks, companies typically focus on implementing multi-layered defense strategies. This includes maintaining rigorous patch management to close vulnerabilities, enforcing strong identity and access management protocols, and conducting regular security awareness training for employees to recognize phishing attempts.

Furthermore, because ransomware actors frequently employ double-extortion tactics, the risk of sensitive data being published remains a primary concern for targeted organizations. Maintaining comprehensive offline backups and implementing data loss prevention (DLP) tools are common defensive steps taken to reduce the impact of such breaches. As public information regarding the Blacklock group remains limited, organizations are encouraged to maintain high levels of vigilance against potential follow-on attacks or data leaks.