Home All Victims Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco...

Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco...

blacknevas

This record tracks a ransomware attack claimed by the blacknevas group against Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco.... It collects the publicly disclosed attack details — sector, location and timeline — as published on the operator's leak site and indexed by Dark Eye.

Window Zero

EXPOSURE GAP

Window Zero is the time the breach stayed in the open before anyone said so — the gap between when the attack was first discovered on the operator's leak site (t1) and when it was publicly disclosed (t2). The wider this window, the longer victims, staff and customers were exposed with no warning.

14days open
t1 · Published t2 · Pending
Aug 25, 2026Not disclosed yet
Country
Business Category
Manufacturing / Engineering
Employees
+1000
Discovered
2026-09-08
Published
August 25, 2026
Leak Status
pending
checked 2026-09-08
Disclosed / Notified
Not disclosed yet
Victim ID
qJOmq0xkjtoC

Attack Summary

https://send.exploit.in/#37608d72633301fc62801dfdf9111dbe!BsYvGiQz6WmjZo1VvPwTi8lU2K7prrPY2q6CdMORZn0List of files. For details and cooperation, write to Telegram https://t.me/BlackNevas or email [email protected] Group is a Turkish industrial group (headquartered in Ankara), founded in 2006. It operates in industrial manufacturing, plastics, rubber, processing, and logistics. The group has over 115,000 m² of production space, over 2,000 employees, and several facilities in Turkey, Romania, and Poland. Its main areas of focus are the automotive industry, white goods, and related industries.MILKRUN — Milkrun Lojistik, the group's logistics division. It provides integrated and smart logistics solutions for group companies and partners (focusing on efficiency, digitalization, and sustainability). It is not the Australian grocery delivery service of a similar name.Efachem, a division specializing in plastic and rubber compounds (compound solutions), develops customized formulas to meet customer needs, ensuring compatibility with production processes and consistent quality.Ecopolymer, a division specializing in raw materials processing and technology, utilizes cutting-edge recycling technologies, converting plastic waste into high-performance raw materials within the framework of a circular economy.All these companies operate as a single ecosystem: production (MEFA Endüstri), raw materials/compounds (Efachem), processing (Ecopolymer), and logistics (Milkrun).

Leak Screenshots

5 CAPTURED

Captured directly from the operator's leak site by our collector, last checked 2026-09-08. Verdict evidence: [M1] https://send.in/exploit?#36708d64c2f133306281fd9f111dbeBYsGVQz6WmiZoVvVpWtiTl8U2K7prrPY2g6CdMORZn0

Proof files published by the operator — 4 image(s) harvested from this entry. Content is locked; type and dimensions shown.

No text found
No text found
No text found
Unclassified
Showing the latest capture only
Unlock the daily capture history — up to 45 days of evidence, plus the 4 proof file(s) the operator published.

Dark Web Exposure

Cross-referenced against HaveIBeenRansom's dark-web index of ransomware leaks, breaches & infostealer logs.
0
found in Infostealer logs
0
found in Traditional breaches
0
found in Ransomware leaks
Emails exposed
••••
Internal
•••
External
•••
Distinct leaks
••
••••••••••••••••••••••••
•••••••••• · ••••••
••• emails
••••••••••••••••••••••••
•••••••••• · ••••••
••• emails
••••••••••••••••••••••••
•••••••••• · ••••••
••• emails
••••••••••••••••••••••••
•••••••••• · ••••••
••• emails
Full exposure is locked
See every breached email, the internal-vs-external split and each leak source behind this victim.
Want the complete picture — passwords, machines, full leak files? It's all searchable on HaveIBeenRansom.
Search this victim →
Visit Website Original Post View Group: blacknevas
Legal Disclaimer: This ransomware victim record reflects information published on the operator's leak site. Dark Eye only records what the operators themselves publish in the open. We take screenshots of their public pages and keep the proof material they post there, so that a listing can be verified and its status tracked over time. We do not purchase data, we do not solicit or encourage its publication, we do not access any private system, and we do not alter anything we record. Nothing is offered for download here, and detailed content is not published on this page or anywhere else on the public site: access to it is restricted to vetted customers under contract, for incident response, due diligence and cyber-resilience work. Dark Eye is not affiliated with, and does not act on behalf of, the operators who publish this material. If you represent an organisation or individual named here and want a record reviewed or removed, contact us and we will act on it.