Cash and carry - COSAEN GRUP Listed by blacknevas Ransomware Group

On May 30, 2025, the Romanian food wholesaler Cosaen Grup SA appeared on the leak site of the Blacknevas ransomware group, with attackers claiming to have exfiltrated 983,158 internal files totaling 243 GB of data.

Reported Details of the Breach

Public reporting indicates the company, which operates wholesale and retail warehouses supplying food, beverages, fresh and dry goods across Romania, had its internal files taken during a ransomware incident. The Blacknevas leak page lists the full directory of stolen material and offers samples upon request via the file-sharing service Gofile. The group states it is actively contacting the company’s partners, friends, and clients to negotiate the purchase of the data. Available reporting describes the listing as still active with no confirmed evidence of mass publication at the time of writing.

Why This Matters for You and Your Family

When a supplier or service provider you use suffers a breach, your personal information often travels with it. Purchase records, delivery addresses, phone numbers, email accounts, and payment details stored in supplier databases can surface in ransomware leaks. For ordinary families this means heightened risk of identity theft, targeted phishing, and unwanted solicitations. 243 GB is a substantial volume; even a fraction of that cache can contain spreadsheets linking customer names to contact information and transaction histories. Once such data leaves the company’s control, it circulates indefinitely on dark-web forums and can be resold for years.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company. Criminals map relationships between suppliers, customers, and employees, then follow the chains to additional victims. A delivery address tied to your name can be cross-referenced with social-media handles, children’s school accounts, or gaming usernames. These connections allow attackers to build detailed profiles that lead to doxxing, account takeovers, or extortion attempts. Credential leaks of this nature frequently cascade into gaming platforms, where children’s accounts become entry points for further compromise because the same email or password is reused across services.

Blacknevas Ransomware Group Track Record

Public reporting attributes Blacknevas with emerging in late 2024 as a double-extortion operation. The group is known for targeting mid-sized businesses across Europe and Latin America, with prior victims including manufacturing, logistics, and retail firms. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. They then publish samples on their leak site and pressure victims and their business contacts to pay for non-disclosure. Industry trackers note the group’s willingness to contact third parties directly, increasing reputational pressure on the primary victim.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you have used with Cosaen Grup or its related services anywhere it is reused, and switch on 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to the same credential chains.
• Let remediation specialists manage takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The speed with which ransomware data moves from leak sites into criminal marketplaces leaves little room for delay. Taking concrete steps now limits how far your information can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—making it an effective shield against the cascading takeovers that often follow incidents like the Cosaen Grup breach.