Cash and carry - COSAEN GRUP Listed by blacknevas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Cosaen Grup SA, a Spanish cash-and-carry operator in the food and beverage sector, was listed on 30 May 2025 by the ransomware group blacknevas. Public reporting indicates that the group claims to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and independent confirmation of the incident’s full scope has not been released.

The listing matters because organisations of this type handle operational, commercial and sometimes personal data that can affect employees, suppliers and business partners if it circulates beyond authorised channels. At present the only detailed claims come from the threat actor itself.

Breaking down the breach

According to the blacknevas listing dated 30 May 2025, Cosaen Grup SA was the target of a ransomware attack in which internal files were taken. The group states that 983 158 files totalling 243 GB are “in stock” and offers a sample list of files via a third-party file-hosting link. It invites interested parties to request samples and to contact the group to discuss acquisition of the data. No further technical details—such as the initial access vector, the exact date of intrusion, or whether encryption was also deployed—have been disclosed by the company or by independent investigators. The volume of people whose information may be involved is likewise unconfirmed.

Public detail is therefore limited to the group’s own claims. There has been no official statement from Cosaen Grup SA confirming or denying the breach, nor any independent verification of the file count or contents at the time of reporting.

The group behind it: blacknevas

Blacknevas is a ransomware operation that follows the now-familiar double-extortion model: data is stolen before systems are encrypted, and the stolen material is advertised on a dedicated leak site if the victim does not pay. The group typically posts brief victim descriptions, file counts and sample downloads, then solicits buyers or pressures the organisation through public exposure. Prior listings by blacknevas have covered a range of mid-sized commercial and industrial targets, with the same pattern of offering file samples and inviting contact for purchase. In this case the listing for Cosaen Grup SA follows that established pattern; the claims of 983 158 files and 243 GB remain unverified assertions by the group.

Cosaen Grup SA and its sector

Cosaen Grup SA operates wholesale and retail cash-and-carry warehouses that supply a wide range of food, beverage, fresh and dry goods. Businesses of this kind sit at the intersection of logistics, inventory management and trade relationships with producers, distributors and retail customers. They routinely maintain records of suppliers, purchase orders, pricing agreements, warehouse inventories and employee information. A successful intrusion into such an environment can therefore expose both commercial intelligence and personal data belonging to staff or business contacts. Because the food-supply chain is tightly interconnected, any disruption or data leakage can also affect downstream partners who rely on the same logistics network.

The information in question

The only data type named in the available reporting is “internal files” said to have been exfiltrated. Blacknevas claims the collection comprises 983 158 files amounting to 243 GB and has published a partial file list as proof. Beyond that assertion, the precise contents—whether they include customer lists, employee records, financial documents, contracts or operational plans—have not been independently confirmed. Organisations in the cash-and-carry food sector typically hold supplier contracts, inventory databases, staff payroll data and internal correspondence; any of these categories could be present, but public sources do not establish which ones, if any, are actually among the stolen material.

What's at stake

For individuals whose details may appear in the files, the practical risks include targeted phishing, identity-related fraud or unwanted contact from parties who obtain the data. Employees could face exposure of personal or employment information; suppliers and business partners could see commercial terms or contact details circulate. For Cosaen Grup SA itself, the consequences centre on potential regulatory scrutiny, loss of commercial confidentiality, and the operational cost of investigating and remediating the incident. Because the number of affected people is unknown and the exact data types remain unconfirmed, the scale of these risks cannot yet be quantified. The mere public listing, however, already places pressure on the organisation and on anyone whose information might be included.

What to do if you're exposed

Anyone who has had a professional or employment relationship with Cosaen Grup SA should treat the possibility of exposure seriously. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and other critical services, and be alert to phishing messages that reference the company or the food-supply sector. If you receive unexpected requests for personal or financial information, verify them through known official channels rather than replying directly. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Should further details about the Cosaen Grup SA incident become public, additional tailored advice may follow; until then, standard hygiene measures remain the most practical first steps.

AICompiled with AI assistance from public sources and published under our editorial standards.