Yateem Group Listed by blacknevas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 24 April 2023, the Yateem Group was listed by the ransomware group blacknevas, which claimed responsibility for a ransomware attack involving the exfiltration of internal files. Public reporting indicates the group asserted that more than 500 gigabytes and over 100,000 files were available, including extensive customer and employee records. The number of people affected remains unknown, and independent confirmation of the full scope has not been established in available details.

The listing matters because Yateem Group operates a substantial retail footprint, including nearly 100 optical outlets alongside other brands and facilities. Any confirmed exposure of customer contact data or employee personal documents would carry lasting practical consequences for individuals whose information may have been taken.

Breaking down the breach

According to the blacknevas listing reported on 24 April 2023, the group claimed to have conducted a ransomware attack against Yateem Group in which internal files were exfiltrated. The group further stated that 500-plus gigabytes and more than 100,000 files were available. It asserted that a complete customer database containing phones and emails of more than 9,000,000 records had been downloaded, along with internal employee information that included passports, rights, work contracts and insurance details. The group also claimed the organisation’s IT department was aware of the leak, that negotiations had been broken off, and that customer and employee data was being prepared for public release.

No independent verification of the attack method, initial access vector, exact timing of intrusion, or confirmation that the claimed volumes and file counts were accurate has been provided in the available record. The number of people affected is listed as unknown. Beyond the group’s own statements on its leak site, public detail on the incident remains limited.

Who is blacknevas?

Blacknevas is a ransomware operation that follows the now-common double-extortion model used by many such groups: data is stolen before systems are encrypted, and the threat of public release is used to pressure victims. Groups of this type typically maintain dedicated leak sites where they post victim names, sample files or full archives when ransoms are unpaid. They often claim large data volumes and sensitive document sets to increase leverage.

Public reporting on blacknevas has associated the name with listings of corporate victims across various sectors. As with other ransomware actors, claims made on leak sites are assertions by the group itself and are not automatically confirmed. In this case, the description of the Yateem Group incident, the stated file volumes, the customer-record count and the assertion that negotiations had ended all originate from the group’s listing and should be treated as unverified claims unless corroborated by the organisation or independent investigators.

Who is Yateem Group?

Yateem Group is a commercial organisation that, according to the material accompanying the listing, owns nearly 100 optical outlets in addition to other brands and facilities. It presents itself as retaining family values established by its founders. Organisations of this type typically operate retail and service businesses that collect customer contact details for appointments, purchases, loyalty programmes and after-sales care, and that hold standard human-resources records for staff.

A breach affecting such a group is consequential because optical and multi-brand retail operations routinely process personal identifiers, contact information and, in some cases, health-adjacent or identity documents. Employee files commonly include contracts, identification copies and insurance data. Exposure of either category can create ongoing risks for the individuals concerned and operational and reputational pressure for the organisation.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The blacknevas listing claimed a complete customer database with phones and emails exceeding 9,000,000 records, plus internal employee information comprising passports, rights, work contracts and insurance. It also stated that more than 500 gigabytes and over 100,000 files were available and were being prepared for public release.

These specific contents and volumes are claims made by the group. The precise data types confirmed as exposed beyond “internal files” are not independently detailed in the available record. Organisations in retail and optical services typically hold customer names, phone numbers, email addresses, purchase or appointment histories, and employee records that may include identity documents, contracts and benefits information. Whether every category asserted by blacknevas was in fact taken, and in what completeness, remains unconfirmed publicly.

What's at stake

For customers, the primary risks centre on unwanted contact, phishing and social-engineering attempts that exploit leaked phone numbers and email addresses. Large contact databases are frequently reused by criminals for spam, scams or credential-stuffing attacks against other services. If identity documents or detailed personal records were included, the longer-term risk of identity misuse rises.

For employees, exposure of passports, work contracts and insurance information can enable targeted fraud, impersonation or further social engineering directed at the individuals or the company. For Yateem Group itself, the stakes include regulatory scrutiny where data-protection rules apply, potential notification obligations, loss of customer trust, and the operational cost of investigation and remediation. Because the number of people affected is unknown and the full contents unverified, the exact scale of harm cannot yet be stated.

Were you affected?

If you are a customer or employee of Yateem Group or its associated outlets and brands, treat the possibility of exposure seriously until more definitive information appears. Monitor financial and email accounts for unusual activity, be cautious of unexpected calls or messages that reference the company or personal details, and consider placing fraud alerts where appropriate. Change passwords on any accounts that reused credentials linked to email addresses you provided to the group.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. This does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding whether your information has circulated more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.