LATCOM Listed by blacknevas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose professional or personal details sit inside advertising and media-planning systems may now face uncertainty after a ransomware group publicly listed LATCOM. When internal files are claimed to have been taken, the practical stakes include possible exposure of campaign data, client information, employee records or operational documents that could be misused for fraud, targeted phishing or competitive harm. Exact numbers of individuals affected remain unknown, so the immediate concern is simply that the claim exists and that the data volume described is large enough to matter.

On 19 October 2025 the group blacknevas listed LATCOM on its leak site, asserting that it had exfiltrated internal files during a ransomware attack. Public detail is limited to that listing and the accompanying claims; no independent confirmation of the intrusion or of the full contents has been supplied in the available record.

What happened

According to the blacknevas listing reported on 19 October 2025, the group claims to have compromised LATCOM and removed internal files. The listing states that 145 146 files totaling 1 TB were taken and offers a file listing together with a promise to supply individual files for verification. The method of initial access, the precise date of the intrusion, whether encryption was also deployed, and whether any ransom demand was paid are all undisclosed. The number of people whose data may be involved is likewise unknown. The only concrete assertions available are those made by the group itself on its leak site; they have not been independently verified in the public record.

Inside blacknevas

Blacknevas is a ransomware operation that follows the now-common double-extortion model: data is first copied out of the victim network, after which systems may be encrypted and a public leak-site entry is used to pressure the organisation into paying. Groups of this type typically advertise stolen file counts and sample downloads to demonstrate possession, then threaten progressive release if negotiations fail. Prior public activity by blacknevas has followed the same pattern of listing corporate victims, posting volume claims and offering selective file samples. In the present case the group claims it holds LATCOM material and will supply files from its list upon request; those statements remain unverified claims rather than What's Publicly Reported.

About LATCOM

LATCOM describes itself as a company specialised in out-of-home advertising with global reach. It focuses on media strategy, planning and implementation of outdoor campaigns, and states that it operates a proprietary platform holding a large industry database used for targeting, execution, control and reporting. Organisations of this kind routinely process client campaign briefs, audience and location data, media-buy records, financial and contractual documents, and internal employee or partner information. A breach affecting such a firm is consequential because the data sets can contain commercially sensitive planning material and, potentially, personal or contact details of staff, clients and suppliers. The listing therefore raises questions not only for LATCOM itself but for any third parties whose information may have been stored in its systems.

What data was at risk

The blacknevas listing characterises the material as “internal files” exfiltrated in a ransomware attack and asserts a volume of 145 146 files amounting to 1 TB. No further breakdown of file types, databases or personal-data categories is provided in the public report. Organisations operating large out-of-home media platforms typically hold campaign planning documents, audience analytics, client contracts, billing records and internal correspondence; whether any of those categories, or any personal identifiers, were among the files claimed by blacknevas is unconfirmed. The exact contents therefore remain undisclosed, and no statement can be made that specific personal or financial data sets may have been exposed.

The real-world impact

For individuals, the principal risks are secondary misuse of any contact, employment or commercial information that may have been present: phishing messages that appear to come from LATCOM or its clients, social-engineering attempts that reference real campaign details, or identity-related fraud if personal identifiers were included. For the organisation the consequences include potential regulatory scrutiny, contractual notifications to clients, reputational damage and the operational cost of investigation and remediation. Because the number of people affected is unknown and the precise data types are unconfirmed, the scale of individual harm cannot yet be quantified; the concrete risk is simply that internal material is now claimed to be in the hands of a group that publicly monetises such holdings.

Were you affected?

If you have worked with LATCOM, been employed by it, or supplied services to its campaigns, treat any unexpected messages that reference the company with caution. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and consider placing fraud alerts with credit bureaux if you believe personal identifiers may have been stored. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official confirmation from LATCOM or from regulators, if and when it appears, should be regarded as the authoritative source for further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.