T. Choithram And Sons, LLC listed on blacknevas leak site

• Ransomware group: blacknevas
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: October 7, 2025

Blacknevas claims to have compromised T. Choithram And Sons, LLC

The threat actor group known as blacknevas has published an announcement on its leak site claiming to possess sensitive data belonging to T. Choithram And Sons, LLC. This announcement, which appeared on the group's platform on October 7, 2025, follows a claimed attack date of September 29, 2025. The group alleges that they have successfully breached the organization's systems and acquired various types of sensitive information.

In many modern cyberattacks, particularly those involving ransomware, threat actors utilize a method known as double extortion. In this scenario, attackers do not merely encrypt a victim's files to demand a ransom for decryption; they also steal sensitive data to use as leverage. By threatening to leak confidential information on a public leak site, the attackers aim to pressure the organization into paying the ransom to prevent reputational damage or regulatory scrutiny.

Details of the alleged breach and stolen data

According to the claims made by blacknevas, the group has gained unauthorized access to critical infrastructure within the organization. Specifically, the threat actor alleges that they have successfully compromised both SQL and SAP databases. These types of databases are often central to corporate operations, housing essential business logic, financial records, and customer information.

Beyond the database files, the group claims to have obtained highly sensitive personal documentation. The information allegedly stolen includes:

• Employee passport information
• SQL database contents
• SAP database contents
• Documents belonging to IT department personnel

Furthermore, the threat actor has made claims regarding the potential for ongoing access and coercion. The group asserts that they have acquired scanned copies of employee passports and scanned documents belonging specifically to IT department personnel. The group has also claimed that they offer access to the corporate network and have stated an intent to coerce IT department employees into cooperation through the use of this sensitive information.

About T. Choithram And Sons, LLC

T. Choithram and Sons is a well-established supermarket chain and food distributor based in the United Arab Emirates, operating across the Middle East. Founded in 1974, the company offers a wide range of FMCG products and provides logistics services to numerous food retail outlets throughout the region.

Potential impact and organizational risks

The claims made by blacknevas suggest several significant risks for the organization and its stakeholders. The potential leak of corporate databases could lead to the exposure of trade secrets and facilitate supply chain attacks, as attackers may use the stolen information to target the company's partners or vendors. Furthermore, the attempt by the threat actor to leverage sensitive information against specific employees may trigger insider threat risks and undermine the overall operational security of the organization.

For the individuals involved, the breach poses a direct threat to privacy. The compromise of employee passport information and other personal documents significantly increases the risk of identity theft for the affected employees. Such incidents can lead to long-term consequences for individuals, including financial fraud and identity impersonation.

While information regarding the blacknevas group remains limited, the incident may result in legal processes under regional data protection regulations and could lead to significant reputational consequences for the organization. Organizations in the retail and distribution sectors often face these risks and typically focus on defensive measures such as implementing robust access controls, enhancing monitoring of database activities, and conducting regular security awareness training to mitigate the risk of social engineering or coercion-based attacks.