E-CON Packaging Private Limited Listed by blacknevas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
E-CON Packaging Private Limited was listed by the blacknevas ransomware group on April 30, 2026, with internal files reported exfiltrated. Individuals connected to the company should check whether their information was exposed and take protective steps.
Inside the incident
The only confirmed public information is the April 30, 2026 listing by blacknevas, which asserts that internal files were removed during a ransomware operation. The group published a link to a file-hosting service containing the claimed data volume of 312,367 files and 300 GB. No independent confirmation of the data’s authenticity or completeness has been reported, and the company has not issued a public statement on the matter. The number of individuals potentially impacted and the precise method of initial access remain undisclosed.
Inside blacknevas
Blacknevas is a ransomware operator that publicly lists victim organisations on a dedicated leak site after claiming to have encrypted systems and removed data. The group’s typical pattern involves double-extortion: encrypting files for ransom while threatening to publish stolen material if payment is not received. Prior activity attributed to the group has included similar listings of manufacturing and industrial targets, with data volumes sometimes reaching hundreds of gigabytes. In this case the listing itself constitutes the group’s claim; no separate verification of the E-CON incident has been made public.
About E-CON Packaging Private Limited
E-CON Packaging Private Limited was established in 1997 and is registered in Mumbai, Maharashtra, with operations in Silvassa, Dadra and Nagar Haveli. The company manufactures and supplies industrial containers, primarily mild-steel drums, HDPE drums, and lacquered drums in open-head, tight-head, and conical formats. Its customers operate in the chemical, pharmaceutical, and lubricant industries, sectors that routinely exchange specifications, delivery schedules, and compliance documentation. A breach at such a supplier can expose records that document business relationships across regulated supply chains.
What data was at risk
The listing states only that internal files were exfiltrated. No inventory of file types or named data categories has been released. Organisations of this kind commonly store employee records, customer contact lists, purchase orders, shipping documentation, and technical specifications for packaging products. Whether any of these categories are present in the claimed 300 GB archive is unconfirmed.
The real-world impact
Individuals whose details appear in internal files could face increased risk of targeted phishing or misuse of contact information. For the company, exposure of customer or formulation-related documents could affect commercial relationships in tightly regulated industries. Because the number of affected people and the exact nature of the files remain unknown, the scale of any downstream consequences cannot yet be measured.
What to do if you're exposed
Monitor email accounts associated with E-CON Packaging or its customers for unusual messages. Enable multi-factor authentication on any accounts that may share passwords with work systems. Review bank and credit statements for unauthorised activity. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in previously published sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Abans Finserv Listed by blacknevas Ransomware GroupThe company MST (Sanko Makina and ASKO Holding) Listed by blacknevas Ransomware GroupCarrera Casting Listed by qilin Ransomware GroupTOYOTA ASIA TOYOTA INDIA Listed by blacknevas Ransomware GroupLatest breaches
Publicly posted by blacknevas — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.