avril.ca Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 11, 2024, the ransomware group blackbasta listed avril.ca on its leak site, claiming to have conducted a ransomware attack that involved the exfiltration of internal files. Public detail remains limited: the number of people affected is unknown, and independent confirmation of the full scope has not been reported. Avril Supermarché Santé is an independent health-food supermarket chain based in Quebec, Canada, and the listing indicates that a substantial volume of internal material—reported as approximately 550 GB—was taken.

The claim matters because organisations of this type hold operational, financial and employee records that can expose individuals and disrupt business if they circulate. What is known so far rests on the group’s own listing and the accompanying description of the data categories; further verification has not been made public.

Inside the incident

According to the blackbasta listing dated December 11, 2024, the group asserts that it carried out a ransomware attack against avril.ca and exfiltrated internal files. The listing characterises the volume of data as approximately 550 GB or more and enumerates several categories: financial data and accounting material, human-resources files, personal employee documents, material labelled DirectionMagasin, and an additional category simply marked “M.” No further technical details—such as the initial access method, the precise date of intrusion, or whether encryption was also deployed—have been disclosed in the available record. The number of individuals whose information may be involved is listed as unknown. Because the information originates from the threat actor’s site, it constitutes an unverified claim pending any statement or confirmation from the organisation itself.

The group behind it: blackbasta

Blackbasta is a well-documented ransomware operation that emerged in 2022 and has since conducted double-extortion campaigns against organisations across multiple sectors. The group typically gains access through phishing, compromised credentials or unpatched vulnerabilities, then steals data before encrypting systems and threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. Its listings frequently include sample files or folder structures to pressure victims. Blackbasta has been linked to attacks on manufacturing, logistics, professional services and retail entities in North America and Europe. In this instance the group claims to have listed avril.ca and to have taken roughly 550 GB of internal files; no additional statements or proof packages beyond the listing description have been reported in the public record for this specific victim.

avril.ca and its sector

Avril Supermarché Santé is an independent chain of health-food supermarkets founded in 1995 and headquartered at 11 rue Évangéline, Granby, Quebec. The company operates multiple stores across the province and sells groceries, dietary supplements, beauty products and ready-to-eat meals, with the stated aim of making natural and organic goods more accessible. Its website is www.avril.ca and its customer service line is 1-844-375-6446. As a multi-store retailer handling inventory, supplier contracts, payroll and customer-facing operations, it necessarily maintains financial ledgers, human-resources records and store-level administrative files. A breach affecting such an organisation can interrupt supply chains, expose employee personal information and erode customer confidence in a sector that trades on trust and wellness.

What data was at risk

The blackbasta listing states that internal files were exfiltrated and names the following categories: financial data and accounting material, human-resources files, personal employee documents, DirectionMagasin records, and a residual category labelled “M.” The total volume is described as approximately 550 GB or more. No more granular inventory—such as specific document titles, customer records, or payment-card data—has been confirmed in the public facts. Organisations of this type commonly hold employee identification details, payroll information, supplier invoices, store operational reports and internal correspondence. Because the exact contents remain unconfirmed beyond the categories listed by the group, it is not possible to state with certainty which individual records were included.

Why it matters

If the claimed data set is authentic, employees whose personal documents or human-resources files were taken face risks of identity fraud, targeted phishing or unsolicited contact. Financial and accounting material could be used to craft convincing social-engineering attacks against suppliers or banks. For the organisation, the exposure of store-level and directional files may reveal operational practices, pricing or vendor relationships that competitors or other actors could exploit. Even when customer payment data is not explicitly named, the mere association of a trusted health-food brand with a ransomware listing can damage reputation and require costly remediation, notification and monitoring efforts. The absence of a confirmed count of affected individuals leaves many people uncertain whether their own information is involved.

Were you affected?

If you are a current or former employee, supplier or customer of Avril Supermarché Santé, monitor financial statements and credit reports for unusual activity and treat unsolicited requests for personal information with caution. Change passwords on any accounts that may have shared credentials with workplace systems, and enable multi-factor authentication where available. Because the precise list of affected individuals has not been published, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Stay alert for official notices from the company itself, which remain the most reliable source of personalised guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.