Inventory Management and Counting Solutions Listed by blacklock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized business-services firms that hold operational and client data, using leak-site listings to pressure victims after claimed data theft. In this environment, a January 2025 listing of Inventory Management and Counting Solutions by the blacklock ransomware group fits a familiar pattern of double-extortion claims against companies that support retail operations.

Public reporting indicates that blacklock has listed Inventory Management and Counting Solutions, also identified with Datascan, as a victim of a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and independent confirmation of the full scope is limited. The incident matters because the company supplies inventory tools used by retailers, so any compromise of internal systems can create downstream risk for partners and employees.

Inside the incident

According to available records, Inventory Management and Counting Solutions was listed by the blacklock ransomware group on or around 4 January 2025. The listing describes a ransomware attack in which internal files were allegedly exfiltrated. No further public detail has been released on the precise date of intrusion, the initial access method, the volume of data taken, or whether encryption was also deployed. The number of individuals affected is listed as unknown. Beyond the group’s claim that internal files were removed, the technical timeline and full extent of the incident remain undisclosed.

Who is blacklock?

Blacklock is a ransomware operation that has appeared in public threat reporting as a group that conducts double-extortion attacks: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if ransom demands are not met. Like other contemporary ransomware actors, blacklock typically posts victim names, limited company details, and sample claims of stolen data to increase pressure. Its listings are claims made by the group itself and are not independently verified unless confirmed by the victim or other authoritative sources. Prior public activity associated with blacklock has followed the same pattern of naming mid-market organisations across multiple sectors rather than focusing exclusively on any single industry.

About Inventory Management and Counting Solutions

Inventory Management and Counting Solutions is identified in reporting as a business-services firm based in Texas, United States, with 319 employees and reported revenue of $29.1 million. Records further note that Datascan, founded in 1970 and located in Carrollton, Texas, provides retailers with on-demand self-scan inventory solutions delivered through a solution-as-a-service model. Organisations of this type typically maintain systems that track stock counts, store operational schedules, hold employee records, and process client contracts for retail customers. A breach at such a provider can therefore affect both the company’s own workforce and the retailers that rely on its counting and inventory platforms.

The information in question

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No further breakdown—such as employee personal data, customer lists, financial records, or technical credentials—has been publicly confirmed. Companies that deliver inventory-management services commonly hold employee contact and payroll information, client contracts, system configuration files, and operational data related to retail stock counts. Because the exact contents of the claimed exfiltration have not been disclosed or independently verified, it is not possible to state with certainty which of these categories, if any, were involved.

Why it matters

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details, employment data, or other personal identifiers that could support phishing or identity-related fraud. For the organisation itself, the exposure of internal files can disrupt operations, damage trust with retail clients, and create regulatory or contractual obligations to notify affected parties. Because the company serves retailers through a solution-as-a-service model, any compromise of its systems also raises the possibility of secondary impact on those clients’ inventory processes, even if the precise data taken remains unconfirmed. The absence of a confirmed headcount of affected people means the full human scale of the incident is still unknown.

If your data was in this claimed breach

If you believe your information may have been held by Inventory Management and Counting Solutions or Datascan, begin by monitoring financial and email accounts for unusual activity and enable multi-factor authentication wherever possible. Consider placing a fraud alert with major credit bureaus if personal identifiers were potentially involved. Change passwords on any accounts that reused credentials associated with the company. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official notifications, if issued by the company, should be treated as the primary source of guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.