blackwater
ransomware group · aka unknown — no widely reported aliases; not to be confused with the 'BlackWater' hacktivist collective reported against water-sector ICS infrastructure · unknown · active since 2026-07-10 (earliest leak-site post tracked by this dashboard; any earlier activity unknown)
BlackWater is a comparatively new data-extortion/ransomware brand whose leak site this dashboard has tracked since 2026-07-10, with five victims listed through 2026-08-24 and no new posts in the most recent seven days. Its victim set is geographically and sectorally diverse — hospitals in the US and Turkey, Chinese manufacturers and a travel group, a Brazilian gas utility, a pharmaceutical company, and a US housing nonprofit — suggesting opportunistic rather than narrowly targeted operations. Public documentation of the group's operators, affiliate model, tooling, and whether victims are also encrypted is sparse, and attribution and origin are unknown. No ransom demands or earnings figures have been reported in public sources as of the last tracked post. It should not be confused with the 'BlackWater' hacktivist collective named in 2024 water-infrastructure incident reporting.
- Publishes victim names and stolen data on a dedicated leak site for extortion
- Low-volume posting cadence (5 listed victims in roughly the first 6 weeks of tracked activity)
- Victim selection spans multiple regions (China, Brazil, Argentina, Turkey, US) and sectors, consistent with opportunistic targeting
- Initial access vectors, malware used, and per-incident extortion details: not yet widely documented (unknown)
Minidoka Memorial Hospital (US, Idaho), Medical Park (private hospital chain, Turkey), Compass Housing Alliance (US nonprofit housing provider), Tuopu Group (Chinese auto-parts manufacturer), UTour (Chinese travel agency group), Shenzhen Gongjin Electronics (Chinese electronic-components manufacturer), Shalina Healthcare (pharmaceutical company), MSGÁS (gas utility, Mato Grosso do Sul, Brazil), AMCA (Argentina-based organization), Grupo EBD (Brazil)
No public figure.
Leak-site victims12 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| www.ptesm.com | · 22d ago | Sinarmas Cepsa Pte. Ltd. is a joint venture between Cepsa and Sinar Mas Group, specializing in the production and marketing of oleochemicals, particularly fatty alcohols and their derivatives |
| www.amca.org.ar | · Aug 15, 2026 | system breach, data blocking |
| www.shalina.com | · Aug 15, 2026 | system breach, data blocking |
| msgas.com.br | · Jul 25, 2026 | customers' personal data, contract information, internal company data: http://ucfhnoihzgx4wz4beyzfxnh46cs37r4zbq627xyctykpatruvmghbyqd.onion/s/7f89713825a4376e/ |
| txdkj.com | · Jul 10, 2026 | Confidential data will be released soon. |
| www.utourworld.com | · Jun 6, 2026 | Confidential data will be published soon |
| Tuopu | · May 2, 2026 | Founded in 1983 and headquartered in Ningbo, China, Ningbo Tuopu Group Co., Ltd. is a multipurpose enterprise specializing in R&D, manufacturing, and sales of auto parts |
| Compass Housing Alliance | · Apr 30, 2026 | Compass Housing Alliance is dedicated to developing and providing essential services, shelter, and affordable housing to ensure that everyone in the community has a safe place to call home. |
| Shenzhen Gongjin Electronics | · Apr 29, 2026 | Shenzhen Gongjin Electronics, founded in 1998 and also known as T&W, is a telecommunications manufacturing company specializing in broadband communication technology. |
| Grupo EBD | · Apr 18, 2026 | All data will be published soon... |
| Minidoka Memorial Hospital | · Apr 18, 2026 | Data will be published after 7 days. |
| medical-park | · Apr 12, 2026 | Medical Park Hastaneler Grubu is Turkey's leading healthcare group, operating 36 hospitals across 14 provinces with a workforce of 14,000 employees. They offer a wide range of medical services. |
In the newsAll →
No articles mention this group yet.