Evasa Listed by frag Ransomware Group

On June 11, 2025, environmental engineering company Evasa appeared on the leak site of the frag Ransomware Group. The attackers posted samples of internal files that include financial statements, employee passports, and DNI scans — government-issued national identity documents used in several countries.

Reported Details from Reporting

Public reporting indicates the data was taken during a ransomware incident. The frag group published a selection of the stolen material on its leak site, hosted via ransomware.live. The samples explicitly reference employee passports, other personal documents, financial statements, and DNI scans. The total number of affected individuals remains unknown, and Evasa has not yet issued a public statement confirming the breach scope or timeline.

Employee passports and DNI scans represent high-value identity documents that can be used to open accounts, request official replacements, or build synthetic identities. Financial statements add context that can help attackers tailor phishing or extortion attempts.

Why This Matters for You and Your Family

If you or anyone in your household works at Evasa, or if your personal documents were stored in the company’s systems, your information may now sit in a criminal repository. A single exposed passport or national ID can lead to account takeovers, fraudulent loans, or targeted scams months or even years later. Children’s records, if mixed into family-linked files, face similar risks once the data spreads.

Ordinary families rarely discover these exposures quickly. By the time you notice unusual charges or unexpected mail, the information has often moved through multiple hands on underground forums.

The Doxxing and Identity-Chain Risks

Leaked identity documents rarely stay isolated. Attackers combine them with usernames, emails, or phone numbers found in other breaches to map entire households. One exposed work email can link to personal accounts, gaming profiles, and family addresses. This creates an identity chain that turns a corporate breach into personal doxxing material. Gaming accounts belonging to you or your children are especially vulnerable because the same passwords or recovery emails are often reused across work and home.

Frag Ransomware Group’s Known Activity

Public reporting attributes the attack to the frag Ransomware Group. The group emerged in late 2024 and has targeted organizations across multiple sectors by deploying ransomware, exfiltrating data, then threatening to publish it unless a ransom is paid. Their typical playbook involves initial access through common vulnerabilities or phishing, followed by data theft and extortion via leak sites. Notable prior victims include other mid-sized companies whose employee and financial records were similarly released when negotiations failed.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used at Evasa anywhere else it appears, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that can chain back to the same leaked information.
• Let remediation specialists manage takedown requests for any exposed personal documents found circulating online.

The incident shows how quickly corporate data leaks can reach your front door. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of what criminals already hold.