BlackFile Ransomware Gang: How Vishing, Data Brokers, and OSINT Power a New Era of Extortion
TL:DR
Data broker exposure is now a workforce security risk, not just a consumer privacy issue.
CCPA employee protections are fully active and expanding across multiple US states.
Executive-targeted attacks continue rising, with growing concern around physical escalation.
Privacy benefits align HR, Security, Legal, and Finance under one program.
Strong programs focus on employee coverage, household protection, and exposure reduction.
BlackFile burst into public view in February 2026, but Google's Threat Intelligence Group (GTIG) and CrowdStrike trace activity from the same cluster back to at least October 2025.
Google / Mandiant: UNC6671
Palo Alto Networks Unit 42 / RH-ISAC: CL-CRI-1116
CrowdStrike: Cordial Spider
Public-facing leak site: BlackFile
Additional alias: O-UNC-045
Palo Alto Networks' Unit 42 first published the cluster under CL-CRI-1116, and the Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC) issued a sector-wide bulletin in late April 2026. BleepingComputer reported the same week that the group had been tied to a surge of vishing attacks against retail and hospitality organizations across North America, the UK, and Australia, with seven-figure ransom demands.
Researchers link BlackFile with "moderate confidence" to "The Com," the same loose-knit, English-speaking cybercrime ecosystem that produced Scattered Spider (UNC3944), ShinyHunters, and LAPSUS$. On May 11, 2026, BlackFile's leak site briefly returned to announce a shutdown "under this name" — a familiar Com pattern: shed the brand, keep the personnel, relaunch. The tactics, however, are here to stay.
BlackFile is not a brand-new actor; it is the public-facing name for a longer-running threat cluster tracked by multiple vendors, with a brand that may change but an operating model that persists.
The Real Weapon Isn't Malware — It's a Phone Call to You
What makes BlackFile distinctive is what it doesn't use. Per Unit 42's analysis cited by RH-ISAC: "The attackers behind CL-CRI-1116 do not rely on custom malware or tooling. Rather, they focus on Living Off the Land through misuse of Application Programming Interfaces (APIs) and other legitimate internal resources."
The breach almost always starts the same way: a phone rings on an employee's personal cell. GTIG reports that BlackFile callers contact employees on their personal cellular phones, masquerade as internal IT help desk, and cite urgent pretexts like "mandatory passkey migrations" or "MFA updates". Victims are steered to a lookalike SSO subdomain (for example, <yourcompany>.enrollms[.]com), enter their credentials, and approve the MFA prompt — believing they're helping IT set up a new device. In reality, the attacker captures the credential, harvests the MFA token in real time via an adversary-in-the-middle (AiTM) proxy, and immediately registers their own MFA device on the victim's account.
From there, BlackFile pivots through SSO into the entire SaaS stack — Microsoft 365, SharePoint, OneDrive, Okta, Salesforce, Zendesk, HubSpot, Google Workspace. Automated scripts using python-requests/2.28.1 and WindowsPowerShell/5.1 user-agents pull files at scale, searching for string literals like "confidential" and "SSN" to prioritize the most damaging data.
The full attack chain, per GTIG:
Outreach — Caller dials employee's personal mobile claiming to be IT help desk.
Redirection — Victim is sent to a lookalike SSO portal.
Credential capture — Username/password relayed to the real SSO in real time.
MFA interception — Victim approves a "setup" push or types a code.
Device registration — Attacker enrolls a persistent MFA device.
Data theft — Automated scripts hit SharePoint, OneDrive, Salesforce, etc.
Extortion — Initial unbranded ransom note via Gmail, then a branded "BlackFile" demand with a 72-hour deadline.
When victims drag their feet, the pressure escalates: swatting calls against employees and C-suite executives, threatening voicemails to senior leaders, and inboxes flooded with messages from dozens of throwaway Gmail accounts.
Every step that comes after the phone call is technical. But each one depends on the phone call working — and the call only works because the attacker already knew three things before dialing: who you are, where you work, and the personal number you actually answer.
How BlackFile Knows Who to Call: Data Brokers, OSINT, and the Public Dossier on Every Employee
This is the part of the story that doesn't fit cleanly into a vendor IOC list — but it's the foundation of every modern vishing operation.
To dial an employee on their personal cell and sound credible, an attacker needs an enriched profile tying full legal name → current employer and team → personal mobile number → home address (useful for swatting and "verification" answers) → family, prior addresses, neighbors → personal email addresses (for out-of-band ransom threats).
Every one of those data points is sold today on commercial people-search and data broker sites for as little as $29 for a complete dossier, according to research by executive-protection firm BlackCloak covering 750 Fortune 1000 executives. That study found:
99% of executives had personal information on more than 36 data broker sites; a "large percentage" were listed on more than 100.
70% of profiles contained personal social media information and photos.
95% included personal/confidential information about family, relatives, and neighbors.
40% of broker profiles even contained the IP address of the executive's home network.
Average of more than three personal email addresses maintained per executive record.
BlackCloak CEO Chris Pierson summarized the threat bluntly: "Not only could you use address information held by the broker to physically go to an executive's home, but you could use the IP address to digitally break into their home from anywhere in the world." (TechNewsWorld)
ZeroFox's enterprise team scans over 100 data broker sites and ties this exposure directly to vishing — attackers use it for "posing as an employee via phone calls to the IT department; requesting account credential resets; answering security questions (e.g., street names, maiden names)" (ZeroFox). The Social Engineering Framework describes "information brokers" as a primary tool of the trade (Social-Engineer.org), and NATO's Strategic Communications Centre of Excellence documents at the geopolitical level that personal information, login details, leaked records, and medical records are all routinely available from the broker ecosystem (NATO StratCom COE).
Sister groups in The Com confirm the pattern. Cyble's Scattered Spider profile notes that SIM hijacking "typically follows the acquisition of a customer's personal information through phishing attacks or by purchasing compromised account credentials" (Cyble). Practitioners on r/sysadmin put it more plainly: "LinkedIn is a common source for this type of info... LinkedIn crossed with breaches/public databases. Every time we get a new hire they get one of these in the first month."
Put it all together and the BlackFile reconnaissance pipeline looks like this:
Identify the target company (retail, hospitality — high-value SaaS data, large frontline workforces).
Enumerate employees on LinkedIn — names, roles, recent job changes. LinkedIn data is also resold in bulk: in 2021, 700 million LinkedIn user profiles were compiled and sold by a single actor.
Cross-reference each name against people-search and data broker sites for personal mobile numbers, personal email addresses, home addresses, and family details.
Prioritize "soft" targets (new hires, frontline staff) and high-value targets (IdP admins, executives) — exactly the two groups iVerify identifies as the prime mobile-first attack surface.
Dial the personal cell, knowing enough to sound legitimate within thirty seconds.
It is worth being precise about what BlackFile reporting does and doesn't say: GTIG, Unit 42, and BleepingComputer all confirm BlackFile reaches employees on personal cell phones but do not name the specific source of those numbers. The broader research from BlackCloak, ZeroFox, and NATO makes the answer obvious. There are exactly three ways to obtain a stranger's personal mobile number at scale: buy it from a data broker or people-search site, pull it from a breached database on dark-web forums, or cross-reference public OSINT (LinkedIn, leaked résumé sites) with broker enrichment. All three sit on the same pile of exposed personal data. Remove that pile and the attack chain stops at step one.
Why Retail and Hospitality Are Getting Hit Hardest
BlackFile, like Scattered Spider before it, has zeroed in on retail and hospitality. The reasons are structural — and they explain who is next.
Massive, distributed, partially-tech-trained workforces. Retail and hospitality firms employ tens of thousands of frontline workers — store managers, shift leads, hotel front-desk agents — who legitimately receive calls from corporate IT on personal devices and rarely receive the rigorous social-engineering training given to office staff.
High-value SaaS estates. Modern retailers run on Salesforce, SharePoint, ServiceNow, and Workday. A single SSO compromise opens loyalty databases, payment integrations, supplier contracts, and HR records.
Reputational sensitivity. Brand-driven companies have huge incentives to settle quickly. ZeroFox notes that social-engineering attacks on UK retailers in 2024–2025 — widely attributed to Scattered Spider — cost individual companies hundreds of millions of pounds in operational disruption.
But the BlackFile playbook is not sector-locked. GTIG notes BlackFile has hit "dozens of organizations" beyond retail and hospitality, and The Hacker News reports the lateral-movement toolkit works against any SSO-integrated SaaS stack . Healthcare, financial services, manufacturing, and SaaS vendors share the same fundamental exposure: employee personal data sitting on data brokers, ready to be turned into a phone call.
What "Defense" Looks Like When the Attacker Already Knows Everything About Your People
Standard guidance from RH-ISAC, GTIG, and Unit 42 covers the obvious controls, and you should already be doing all of them:
Phishing-resistant MFA (FIDO2, hardware keys) instead of push/SMS/TOTP.
Strict identity verification protocols for help-desk callers — multi-factor proof, defined operational limits, escalation thresholds.
Conditional access rules that flag impossible-travel logins, new device registrations, and anomalous user-agents like python-requests.
VoIP log analysis and CNAM verification for inbound caller-ID spoofing.
Simulation-based vishing training, especially for frontline staff and new hires.
These controls matter. They are also insufficient — because every one of them activates after the attacker has already reached an employee.
The deeper truth, articulated by BlackCloak's Chris Pierson: "If you're targeting the CEO of GE, are you going to hack him at his GE email address, where he's protected by corporate cybersecurity, or are you going [to target his personal accounts]?" . The attacker chooses the path of least resistance — and right now that path runs through your employees' exposed personal data on public data broker sites.
One defensive layer cuts off the attack before the phone rings: systematically removing employee, executive, and contractor personal data from data brokers and people-search engines.
How Priwall by mePrism Mitigates BlackFile-Class Threats
Priwall by mePrism is a privacy-protection service purpose-built to solve this exact problem. Its tagline — "Protect your People. Remove their Data." — captures the model precisely.
Here is how Priwall by mePrism directly counters the BlackFile reconnaissance chain:
1. Removal from 600+ data broker and people-search sites
Priwall continuously scans over 600 online data broker sites and submits opt-out and deletion requests on behalf of the protected employee or executive . That includes the highest-volume people-search engines, Spokeo-class aggregators, infotracer-class profilers, and the broader LexisNexis-style commercial ecosystem — the same sources a BlackFile-class crew uses to obtain the personal cell number, home address, and family details needed for a credible vishing call.
2. Continuous monitoring — because brokers re-list
Data brokers re-acquire, re-purchase, and re-publish. Priwall's Persist & Monitor phase rescans the broker ecosystem on a regular cadence and re-removes data when it reappears — turning data-removal from a one-time project into a steady-state control, the same way EDR did for malware defense.
3. Legal intervention for the most stubborn sites
Some brokers ignore standard opt-out requests, or hide behind technicalities. Priwall escalates with legal intervention for sites that refuse to honor removal requests — a capability most automated-only privacy tools cannot match.
4. Executive protection that addresses the full personal attack surface
mePrism's executive-protection offering is built around the recognition that personal information held by data brokers is the entry point for spear phishing, account takeover, and CEO fraud. The service combines broker scanning with dark-web monitoring for leaked credentials — a second layer against the credential-reuse risk that often compounds vishing breaches.
5. Coverage at enterprise scale — not just for the C-suite
The BlackFile lesson is that frontline employees are now the front door. A program limited to ten executives misses the help-desk agent, the store manager, the new hire on day three. Priwall by mePrism is designed for scalable, organization-wide deployment — continuous scanning, automated removals, centralized dashboards — and is already trusted by Fortune 500 customers across healthcare, finance, executive services, cybersecurity, and retail, with SOC 2 Type 2 compliance maintained for over three years.
6. Compatibility with — not replacement of — your existing stack
Removing employee PII from data brokers is not a substitute for phishing-resistant MFA, conditional access, or vishing training. It is the missing prevention layer underneath all of them, designed to integrate with existing corporate cybersecurity tools and incident-response workflows.
A Reasonable, Cost-Effective Risk Reduction
The economics favor defense. BlackFile ransom demands run in the seven-figure range; the average global breach cost crossed $4.88 million in 2024. Against those numbers, Priwall's individual plans start at $4.17/month and business deployments scale per employee — a fraction of the cost of one tabletop exercise, let alone one incident. Vishing is the dominant intrusion vector for the most damaging extortion crews of 2026 — BlackFile, Scattered Spider, ShinyHunters, LAPSUS$ — and every one depends on data brokers and OSINT to scale.
Action Checklist for Security and Privacy Leaders
If you are a CISO, CSO, IT director, or privacy lead at a retail, hospitality, financial-services, healthcare, or SaaS organization, treat the following as a near-term priority list informed by the BlackFile reporting:
Audit broker exposure for your top 100 employees. Start with executives, IT admins, help-desk staff, payments/treasury, and anyone with high-privilege SSO roles. A free Priwall scan will show you what's currently public.
Deploy continuous broker removal organization-wide. One-time removal does not work — the brokers re-list. You need persistent monitoring.
Roll out phishing-resistant MFA (FIDO2 / hardware keys) for all SSO and admin accounts. Eliminate SMS and TOTP where possible.
Rewrite your help-desk verification procedure. Define exactly what IT support can and cannot do in a single call.
Run vishing simulations quarterly. Train frontline staff to challenge "urgent IT help-desk" calls — and to verify out-of-band.
Hunt for the BlackFile IOCs published by RH-ISAC and GTIG, including the python-requests/2.28.1 user-agent against M365, SharePoint, OneDrive, and Salesforce.
Treat data-broker removal as a security control, not a privacy nice-to-have. Map it into your security program, your vendor-risk reviews, and your executive-protection budget.
The Bottom Line
BlackFile announced its own "shutdown" on May 11, 2026 — but every threat researcher quoted in this article expects the same operators to resurface under a new name within weeks. The TTPs do not retire when the brand does. Vishing, AiTM, SSO abuse, and SaaS-native data theft are now the dominant intrusion model for The Com–affiliated crews, and the input fuel for that model is publicly available personal data — names tied to employers tied to personal phone numbers tied to home addresses tied to family details. All of it on sale, today, for less than the cost of a streaming subscription.
You cannot patch a phone call. You cannot deploy EDR on your employees' personal mobiles. You cannot retroactively un-publish your CFO's home address from forty broker sites by writing a stern email.
But you can remove the data before the attacker dials. That's the entire reason Priwall by mePrism exists, and that's why integrating it into your security program in 2026 is one of the most reasonable, evidence-backed decisions a security leader can make.
Ready to try mePrism yourself?
If you are an individual executive evaluating personal coverage outside an employer-funded program, you can start with a free exposure scan.
Sign up for Priwall by mePrism coverage.By Thomas Daly, CEO, mePrism Privacy. Thomas leads mePrism Inc., the company behind Priwall by mePrism, and writes regularly on consumer privacy regulation and the B2B economics of data-broker removal.