doyon.com | doyondrilling.com Listed by blackbasta Ransomware Group

On April 1, 2024, the ransomware group Black Basta added doyon.com and doyondrilling.com to its public leak site, listing Doyon, Limited — the Alaska Native regional corporation for Interior Alaska — as a victim of a ransomware attack in which internal files were allegedly exfiltrated.

Details in the Leak-Site Listing

The primary disclosure on the Black Basta leak site states that Doyon, Limited and its drilling subsidiary suffered a ransomware incident and that attackers successfully removed internal files. The listing does not quantify the number of affected records, name the specific data types beyond “internal files,” or disclose the ransom demand. It simply states that exfiltration occurred and gives the company until a deadline to negotiate before the files are published. Doyon, Limited is a for-profit corporation representing more than 20,500 shareholders and employs over 800 people across oil-field services, government contracting, construction, information technology, natural resources, tourism, and real estate.

Why This Matters for You and Your Family

If you or any member of your family is a Doyon shareholder, current or former employee, contractor, or North Slope resident whose records passed through Doyon Drilling Inc., your personal information may now sit inside the exfiltrated archive. Internal files in corporate environments routinely contain Social Security numbers, dates of birth, addresses, banking details for direct-deposit payroll, tax forms, and vendor contracts. Once those files reach the leak site, anyone with Tor can download them. The exposure is permanent: even if Doyon pays or the group is dismantled, copies will circulate on other criminal forums for years.

The Doxxing and Identity-Chain Risk

A single leaked internal spreadsheet can link an email address to a physical address in Fairbanks, a phone number, and the names of dependents. Attackers then chain that data with credential leaks from other breaches, gaming accounts, or social-media handles. The result is a complete identity profile that enables account takeovers, tax fraud, SIM-swapping, or targeted extortion. Credential leaks like this one frequently cascade into gaming platforms; children’s accounts tied to a parent’s reused password become entry points for further doxxing. DoxxScan by GalaxyWarden continuously monitors 13.1 billion+ breach records across more than 100 platforms, uses AI-powered identity-chain mapping to surface these linkages, and provides hands-on remediation by specialists, with household coverage that includes children’s gaming accounts.

Black Basta’s Publicly Known Track Record

Public reporting attributes Black Basta’s first appearances to early 2022. The group rapidly became one of the most active double-extortion operations, encrypting victim networks while simultaneously exfiltrating data for leverage. Notable prior victims include large healthcare providers, financial services firms, and manufacturers. Their typical playbook begins with initial access gained through compromised remote-desktop credentials or phishing, followed by lateral movement, data theft, deployment of ransomware, and then dual extortion: demand payment to decrypt and a second payment to prevent publication. The group maintains a leak site on the dark web and routinely follows through on publication deadlines when victims refuse to pay.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring so the next breach that touches your household is caught in hours rather than months.
• Rotate any password you ever used at Doyon or Doyon Drilling anywhere it has been reused, and switch to 2FA through an authenticator app instead of text messages.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that can chain back to the same leaked address or parent email.
• Let the remediation specialists handle takedown requests across data brokers and forums for you while you focus on securing your own accounts.

The incident shows that even established regional corporations with thousands of shareholders can have their internal data exposed without warning. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this leak. Start your DoxxScan trial and put continuous monitoring and specialist remediation to work for your entire family.