CILI Listed by blacknevas Ransomware Group

On July 2, 2025, the ransomware group blacknevas added the Lithuanian restaurant chain Čili to its leak site, claiming that it had exfiltrated internal files containing customer data from the company behind cili.lt and its mobile ordering app.

Reported Details of the Breach

Public reporting indicates that Čili, which operates restaurants, bistros, coffee shops and drive-ins across Lithuania and Latvia, suffered a ransomware attack in which attackers copied internal databases. The exposed information includes customer addresses, email addresses, mobile phone numbers, shopping history and banking card details. The exact number of affected customers remains unknown. The group published proof of the exfiltration on its dark-web leak site, following its standard practice of posting stolen data when victims do not meet ransom demands.

Why This Matters for You and Your Family

When a restaurant chain you order from loses control of names, addresses, phone numbers and payment card data, the risk reaches beyond that single company. Addresses and mobile phones can be used to locate you or your family members. Email addresses and passwords reused from other services become immediate targets for account takeovers. Shopping history reveals patterns that help attackers build convincing phishing messages. If your children use the same email or phone number for their gaming accounts, those profiles can be linked back to your household address within minutes. A single breach like this can quietly feed months of identity theft, spam, scams and physical risks if the data spreads across criminal marketplaces.

The Doxxing and Identity-Chain Risk

Attackers rarely stop at one database. They combine the Čili records with information from earlier breaches to create an identity chain that links your email, phone, home address, family names and online handles. Once that chain exists, doxxing becomes straightforward: an attacker can publish your address alongside your children’s usernames or expose your full shopping history to embarrass or intimidate you. Credential leaks of this type frequently cascade into gaming account takeovers, because children often reuse the same passwords or recovery phone numbers that appear in adult-facing breaches. The result is a widening circle of exposure that can affect every member of the household.

Blacknevas Group Track Record

Public reporting attributes blacknevas with emerging in late 2024 as a ransomware operation that combines double-extortion tactics with public leak sites. The group has listed retail, hospitality and healthcare victims, typically gaining initial access through phishing or exploited remote desktop services, exfiltrating data before encrypting systems, then demanding payment to prevent publication. Its playbook relies on steady pressure through countdown timers and sample data dumps, a pattern consistent with the Čili listing.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you used on cili.lt or the Čili app anywhere else it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is flagged within hours instead of months.
• Cover the household with DoxxScan family protection, which extends to children’s gaming accounts that often chain back to the same addresses and phone numbers exposed in breaches like this one.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The Čili breach is a reminder that everyday services can expose the details that tie your family’s digital and physical lives together. Acting quickly on the exposed data types can limit damage before it spreads further. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this incident has opened.