Undefasa listed on blacknevas ransomware leak site

• Ransomware group: blacknevas
• Country: Spain
• Sector: Manufacturing
• Announcement date: October 13, 2025

Blacknevas claims to have stolen data from Undefasa

The blacknevas ransomware group has listed the Spanish ceramics manufacturer Undefasa on its leak site. According to the announcement made on October 13, 2025, the threat actors claim to have successfully exfiltrated a significant amount of data from the organization. The group alleges that the attack took place on October 9, 2025.

The details surrounding the blacknevas group remain limited in the public domain, as there is very little information available regarding their specific tactics, techniques, or overall profile. Despite this lack of public data on the group itself, the scale of the alleged breach is substantial. The threat actors claim to have acquired a dataset totaling 2.3 TB, which reportedly consists of 102,634 files. This data has been shared via a public platform by the group.

Details of the allegedly leaked information

Based on screenshots provided by the threat actors, the leaked dataset appears to contain sensitive corporate and personal information. The files allegedly include various types of documentation that could be used for malicious purposes. The specific categories of data identified in the leak include:

• Employee personal data
• Salary information
• Employment contracts
• Customs and logistics documents
• Financial data

The exposure of such diverse documentation, ranging from internal payroll records to external customs documents, suggests a deep level of access to the organization's internal systems and administrative processes.

About Undefasa

Undefasa is a family-owned business based in Spain that has been operating since 1967. The company is a player in the ceramics manufacturing industry, where it focuses on design, innovation, and durability. Their product range is designed for both indoor and outdoor spaces, providing a variety of ceramic products to their customers.

Potential impact and industry implications

The alleged leak of this data poses several significant risks to Undefasa, its employees, and its business partners. For the individuals whose information was taken, there is a heightened risk of identity theft or the targeting of employees through sophisticated phishing attacks. Because the company is headquartered in Spain, this incident may lead to legal sanctions under the European Union's General Data Protection Regulation (GDPR).

Beyond the immediate privacy concerns, the breach could have broader consequences for the company's operational continuity and commercial reputation. The exposure of customs and financial documents is particularly concerning, as it could compromise supply chain security and create secondary attack vectors against third parties involved in the company's logistics and financial networks.

In the broader context of cyber threats, ransomware groups often employ double extortion tactics, where they not only encrypt an organization's data but also threaten to leak sensitive information on public platforms to increase pressure for ransom payments. This method is designed to maximize the leverage held by the attacker. To defend against such threats, organizations in the manufacturing sector often implement security measures such as robust backup solutions, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data exfiltration.