D&G Enviro-Group Listed by blacklock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have worked with or for D&G Enviro-Group, or who have shared personal or business details with the firm, now face the practical question of whether their information sits among files claimed to have been taken in a ransomware incident. Public reporting does not yet confirm how many individuals are involved or exactly which records left the company’s systems, so the immediate stakes remain uncertain but real for anyone connected to the organisation.

On 28 December 2024 the ransomware group known as blacklock listed D&G Enviro-Group on its leak site, asserting that internal files had been exfiltrated. The claim has not been independently verified in the available public record, yet the listing itself is enough to warrant careful attention from clients, partners and staff.

Breaking down the breach

According to the public listing, D&G Enviro-Group was named by blacklock on 28 December 2024. The group states that internal files were removed during a ransomware attack. No further technical detail—such as the initial access method, the duration of the intrusion, the volume of data taken, or any ransom demand—has been disclosed in the source material. The number of people whose information may be affected is listed as unknown. Public reporting therefore establishes only that a claim of data theft has been made; it does not confirm the scale, the precise contents, or whether any files have been released.

The organisation is described as a Canadian firm operating in the energy, utilities and waste sector, with fewer than 25 employees and annual revenue under five million dollars. Beyond that profile and the leak-site claim, the public record on the incident itself remains limited.

Who is blacklock?

Blacklock is a ransomware operation that has appeared in open-source reporting as a group that encrypts systems and simultaneously steals data, then pressures victims by threatening to publish the material on a dedicated leak site. Like other contemporary ransomware crews, it typically posts victim names, sometimes with sample files or file counts, to demonstrate possession of the data. The group’s listings are claims rather than independently audited disclosures; security researchers treat them as indicators that require verification rather than as settled fact.

Blacklock has been observed following the common double-extortion pattern: data exfiltration followed by encryption and a public countdown. Prior activity attributed to the group in public sources shows a focus on mid-sized organisations across multiple sectors, though no specific earlier claims about D&G Enviro-Group appear in the material provided for this incident. Any assertion that blacklock holds particular files belonging to this company rests solely on the group’s own listing.

About D&G Enviro-Group

D&G Enviro-Group is a small Canadian environmental-services company operating in the energy, utilities and waste sector. Public descriptions indicate a flexible corporate structure designed to deliver personalised, cost-effective solutions tailored to individual client projects. With fewer than 25 employees and revenue reported below five million dollars, the firm is typical of specialised consultancies that handle site assessments, regulatory compliance, waste management planning and related environmental work.

Organisations of this type routinely collect and store project documentation, client contact details, contractual records, site photographs, laboratory results, and correspondence with regulators or contractors. Because the work often involves sensitive environmental data and client-specific operational information, a compromise can affect both the company’s own operations and the privacy or competitive position of the parties it serves. The small size of the firm means that any disruption to systems or loss of trust can have outsized operational consequences.

The information in question

The only data category named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of specific document types, databases, or personal-data fields has been published. Exact contents therefore remain unconfirmed.

In the ordinary course of business, an environmental-services firm of this profile would be expected to hold client names and contact information, project proposals and reports, invoices and payment records, employee or contractor details, and technical files related to environmental assessments or waste-handling plans. Whether any of those categories were among the files claimed by blacklock is not stated in the public record. Readers should treat the exposure of any particular record as possible rather than proven until further confirmation appears.

What's at stake

For individuals whose details may be present, the concrete risks include unwanted contact, phishing attempts that reference genuine project or employment information, and the possibility that personal identifiers could be combined with other leaked data sets. For client organisations, the concern centres on the potential release of proprietary site data, commercial terms, or regulatory correspondence that could affect competitive standing or compliance posture.

For D&G Enviro-Group itself, the listing raises operational and reputational questions: restoration of systems if encryption occurred, notification obligations under Canadian privacy law, and the need to reassure clients that remaining data is secure. Because the number of affected people is unknown and the precise files are undisclosed, the full scope of these risks cannot yet be quantified. The absence of Reported Details does not eliminate the need for vigilance; it simply means responses must remain proportionate to what is actually known.

If your data was in this claimed breach

Anyone who has supplied personal or business information to D&G Enviro-Group should treat the claim as a prompt for basic hygiene rather than confirmed compromise. Change passwords on any accounts that may have reused credentials shared with the firm, enable multi-factor authentication where available, and watch for unexpected emails or calls that reference environmental projects or invoices. Monitor financial and credit activity for unusual behaviour. If you receive notification directly from the company, follow the guidance it provides.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets. Such a scan does not prove or disprove involvement in this specific incident, but it offers a practical starting point for understanding one’s broader exposure surface.

AICompiled with AI assistance from public sources and published under our editorial standards.