Quality Data Service, Inc.
bd_fae398c15f253644 · schema v1 · pii pii-v1
Full breach record for Quality Data Service, Inc. →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Blacknevas on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Today, we’re opening the auction.Over the past several weeks, we’ve completed a full exfiltration from the infrastructure of Quality Data Service, Inc., Connecticut’s most “trusted” municipal software provider. The haul: approximately 300 GB of internal company data, including:SQL databases of client municipalities, tax departments, GIS records, and user credentialsGigabytes of PDFs, XLS files, DOC reports — many containing deeply sensitive financial, geographic, and personal data with contatsInternal emails, technical logs, software source code archives, vulnerability reports, and support ticketsMost importantly: comprehensive information on over 200 Connecticut municipalities, their operational structures, internal correspondences, and revaluation recordsThese aren’t just files. These are lives, towns, histories, and vulnerabilities — trusted to a company that no longer respects the responsibility it bears.Why Are We Doing This?We approached Quality Data Service, Inc. privately before publishing anything. Our intent was not destruction. But from the Founder & President, to the CFO, Director of Assessor Support,ITs and others — we received silence, evasion, or worse: denial.They knew.They were warned.They did nothing.Their refusal to act wasn’t just negligence — it was an act of contempt for every municipality they serve.It’s not just about stolen data. It’s about a culture that prioritizes profit over protection, and PR over real recovery. And when cybersecurity “experts” are called in only to recommend burning what’s left — that’s not incident response. That’s malpractice.The AuctionWe are now offering:Full dataset: All stolen data, intact and complete (buyout option)Per-municipality packages: Tailored datasets for each town or districteQuality source code: Core application and modules available separatelyBuyers of individual municipality data will receive excl
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
May 21, 2025
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
blacknevas
According to ransomware.live, BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme.