i-one listed on Black X leak site with claims of data exfiltration

• Ransomware group: Black X
• Country: South Korea
• Announcement date: August 30, 2026

Black X claims to have stolen 1 TB of data from i-one

The threat actor known as Black X has listed the South Korean organization i-one on its leak site, claiming to have exfiltrated 1 TB of data. The announcement, which was published on August 30, 2026, follows an alleged attack that occurred on August 28, 2026. This incident highlights the ongoing threat posed by ransomware groups that utilize double extortion tactics to pressure victims.

In a double extortion scheme, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as a secondary layer of leverage, forcing the organization to choose between paying a ransom or facing the public exposure of its proprietary and sensitive information.

The threat actor's demands and claims

According to the claims made by Black X, the group has obtained significant amounts of technical data belonging to i-one. The threat actor has stated that if the company fails to establish contact with them, the group will proceed to leak all the stolen information. The group has threatened to release a wide range of sensitive documentation to the public if their demands are not met.

The announcement suggests a high level of intent to cause reputational and operational damage through the release of internal documents. While the specific ransom demand has not been disclosed by the group, the threat of total data exposure remains the primary driver of the extortion attempt. The group has provided screenshots that appear to display various file lists and technical diagrams to support their claims of having access to the company's internal environment.

Alleged stolen data types

The data claimed to be held by the Black X group includes a variety of sensitive business and technical documents. The specific categories of information mentioned in the leak site announcement include:

• Technical data
• Sales records
• Technical drawings
• Quality documents
• Logistics data
• Supply chain information

About i-one

I-ONE is a South Korean automotive parts manufacturer. The company specializes in the production of various technical components and parts for the automotive industry.

Analysis and potential risks

This incident suggests that i-one may face a significant risk of exposure regarding its intellectual property and trade secrets. Given the nature of the automotive manufacturing sector, the loss of technical drawings and quality documents could impact the company's competitive advantage and proprietary manufacturing processes. Furthermore, because the company operates within South Korea, it may face specific legal obligations and regulatory scrutiny under the Personal Information Protection Act (PIPA).

The inclusion of supply chain information in the alleged leak is particularly concerning as it may create secondary risks for the company's business partners. When supply chain data is exposed, it can provide malicious actors with the necessary intelligence to launch highly targeted phishing attacks against partners or other entities within the same industrial network. Such attacks often leverage specific details about logistics, vendors, or procurement processes to appear legitimate.

As a general defensive measure, organizations facing such threats often need to conduct thorough forensic investigations to determine the actual scope of the data breach and identify the entry point used by the attackers. Additionally, notifying relevant authorities is a critical step in managing the legal and regulatory consequences of a data breach. Because public information regarding the Black X group remains limited, organizations should remain vigilant against the evolving tactics used by such threat actors.