EVAS Group Listed by blacklock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized organisations across sectors, using double-extortion tactics that combine system encryption with data theft and public leak-site pressure. In this landscape, listings of previously unpublicised victims appear regularly, often with limited independent confirmation of the underlying intrusion.

On 10 January 2025, the ransomware group blacklock listed EVAS Group as a victim, claiming to have exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and public detail on the incident is limited. For an organisation of this size operating in Canada, any confirmed exposure of internal material carries practical consequences for staff, partners and clients.

Inside the incident

Public reporting states that EVAS Group was listed by the blacklock ransomware group on 10 January 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further verified information has been released about the date of initial access, the specific systems involved, the volume of data taken, or whether encryption was successfully deployed. The number of people affected is unknown. Independent confirmation of the claims made on the leak site has not been published, so the listing itself remains an unverified assertion by the threat actor.

Inside blacklock

Blacklock is a ransomware operation that follows the now-common double-extortion model: after gaining access, operators typically steal data before encrypting systems and then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. Like other groups in this category, blacklock maintains a public blog or portal where it names victims and sometimes releases sample files to increase pressure. Its activity has been observed against organisations of varying sizes across multiple countries and industries. The group’s listing of EVAS Group should be treated as a claim rather than established fact unless corroborated by the organisation or independent investigators.

Who is EVAS Group?

EVAS Group is a Canadian organisation reported to employ approximately 294 people and to generate roughly $12.5 million in revenue. Public descriptions associate it with EVAS Air Charters, which provides specially configured aircraft for corporate and business-class travellers, offering customised schedules, in-flight services and executive-level preferences. Organisations of this type typically maintain operational records, customer booking and preference data, employee information, financial documents and technical or safety-related files necessary for regulated air operations. A breach involving internal files at such an entity is consequential because it can affect both the continuity of specialised charter services and the privacy of individuals whose details appear in those systems.

What was likely exposed

The only data type named in connection with the incident is “internal files” said to have been exfiltrated. Exact contents have not been disclosed. Organisations providing air-charter and related services commonly hold employee records, customer contact and travel-preference information, contracts, financial data, operational manuals and correspondence. Whether any of these categories were among the files claimed by blacklock remains unconfirmed. No public inventory of the stolen material has been released.

The real-world impact

If internal files were indeed taken, affected individuals could face risks of phishing, identity misuse or unwanted contact that draws on personal or professional details. For the organisation, exposure of operational or commercial documents can create competitive, regulatory or contractual complications, and the mere public listing can damage trust among clients who rely on discreet, high-service travel arrangements. Because the scale of the alleged exfiltration and the precise nature of the files remain unknown, the full extent of these risks cannot yet be measured. Recovery typically involves forensic investigation, notification obligations where personal data is involved, and long-term monitoring for misuse of any leaked material.

If your data was in this claimed breach

Anyone who has worked with or travelled via EVAS Group or its air-charter services should treat the possibility of exposure seriously even while details stay limited. Change passwords on related accounts, enable multi-factor authentication where available, and watch for unexpected emails or calls that reference personal or travel information. Monitor financial statements and credit reports for unusual activity. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. If you receive formal notification from the organisation, follow the guidance it provides and retain copies of any correspondence for your records.

AICompiled with AI assistance from public sources and published under our editorial standards.