On December 28, 2024, the Canadian environmental services firm D&G Enviro-Group appeared on the leak site of the blacklock ransomware group, with attackers claiming to have exfiltrated internal files after a ransomware incident. The company, which employs fewer than 25 people and generates under $5 million in annual revenue, provides personalized environmental consulting to clients in the energy, utilities, and waste sectors. Public reporting indicates that customer records, employee information, and operational documents may have been taken, though the exact number of people affected remains unknown.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch D&G Enviro-Group
Get alerted the next time D&G Enviro-Group files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about D&G Enviro-Group’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details of the Breach
Available reporting describes the incident as a classic ransomware attack in which blacklock first gained access, encrypted systems, and then exfiltrated data before demanding payment. The leaked material was posted to an onion site hosted at zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onion, with a direct download link for the D&G Enviro-Group archive. No confirmed victim count has been released, and the precise data types remain unclear beyond the broad category of internal files. The breach was publicly listed on December 28, 2024, giving any impacted parties little advance notice.
Why This Matters for You and Your Family
Even a small company like D&G Enviro-Group handles information that touches real people: supplier contracts, employee payroll details, client addresses, and project files that can contain personal data. If you or anyone in your household has ever worked with an environmental services provider, used waste-management programs, or lived in an area where such firms operate, your information could be among the records now circulating on dark-web forums. Once stolen data leaves the original company, you lose control over who sees it and how it is used. Credential leaks from these incidents cascade quickly into account takeovers that can affect your bank, email, or even your children’s gaming accounts.
The Doxxing and Identity-Chain Risks
Ransomware groups rarely stop at posting generic files. They often comb through stolen documents for email addresses, phone numbers, employee names, and client lists, then cross-reference them with other breaches. This creates an identity chain: one leaked work email leads to a reused password on a personal account, which leads to a home address, which leads to doxxing of family members. Children’s gaming usernames tied to a parent’s work email are especially vulnerable because young users rarely enable strong security. The result is a map that lets attackers harass, impersonate, or extort you and your family long after the original company has moved on.