LATCOM allegedly targeted by blacknevas ransomware group

• Ransomware group: blacknevas
• Country: Argentina
• Sector: Retail & E-Commerce
• Announcement date: October 30, 2025

The advertising firm LATCOM has been listed on a ransomware leak site by the threat actor known as blacknevas. According to the announcement made on October 30, 2025, the group claims to have successfully compromised the organization's data, asserting that the breach occurred around October 19, 2025.

The claims made by blacknevas

The threat actor known as blacknevas has officially listed LATCOM on its leak site, claiming to have obtained a significant volume of the company's data. The group asserts that it possesses 1TB of data, which is comprised of 145,146 individual files. This type of claim is characteristic of modern ransomware operations that utilize double extortion tactics. In such scenarios, attackers not only encrypt a victim's systems to disrupt operations but also exfiltrate sensitive information to use as leverage during negotiations.

To support the legitimacy of their claims and to pressure the victim, the group has stated that it is prepared to provide sample files from the stolen list to confirm the authenticity of the breach. Such samples are often used by ransomware groups to demonstrate to the target that they have successfully bypassed security perimeters and accessed sensitive internal directories.

The data allegedly involved in the breach

Based on the information provided by the threat actor, the leaked data set is substantial in both volume and file count. The screenshots provided by the group indicate the presence of various sensitive corporate documents. These documents appear to include a range of internal administrative and operational files, such as:

• Non-disclosure agreements
• Employment contracts
• Campaign reports
• Financial records

The presence of these specific document types suggests that the breach may have reached into the core administrative and financial functions of the organization, potentially exposing sensitive information related to both employees and business partners.

About LATCOM

LATCOM is a global company specializing in Out-of-Home (OOH) advertising. The organization provides a wide array of services, including media strategy, planning, and campaign management. The company utilizes a technology-driven platform and an extensive industry database to manage all stages of advertising campaigns for its clients.

Analysis and potential implications

The alleged breach may pose significant risks to the company's operational confidentiality and its commercial reputation. Because the sample documents appear to contain third-party agreements and client data, a confirmed breach could lead to legal repercussions under GDPR and other relevant local regulations. The exposure of such data often triggers mandatory notification requirements to regulators and affected individuals.

Beyond the immediate legal and reputational concerns, there are secondary risks to consider. The leaked data could potentially be utilized by malicious actors for identity theft or for launching highly targeted phishing campaigns against the company's employees or clients. Such attacks often use the stolen context—such as knowledge of specific campaigns or contract details—to increase the success rate of social engineering attempts.

Regarding the threat actor, information available about the blacknevas group remains limited. For organizations facing similar threats, it is generally advisable to initiate a comprehensive forensic investigation to determine the exact scope of the leak and to notify all relevant stakeholders. In the broader context of cybersecurity, maintaining robust data encryption, implementing strict access controls, and conducting regular security audits are standard defensive measures used to mitigate the impact of such exfiltration events.