Court Square Group Ransomware Claim by Black X (Nov 2026)

Claim Summary

On or around November 4, 2026, the ransomware group tracked as Black X allegedly listed Court Square Group, a US financial services organization, on its dark web leak site. According to the threat actor, the group claims to have breached the organization’s internal network and purportedly exfiltrated approximately 3TB of data from the RegDocs365 and ARCC cloud environments.

The actor further alleges that the stolen material includes clinical trial data, research materials, and various reports belonging to Court Square Group customers. Notably, the group has not published any data samples at the time of this writing. Instead, it states it will “provide a list of some of the data files currently in our possession within the next few days” and allow the victim to select files for verification. This “prove-it-later” approach is a common pressure tactic and should be treated with skepticism until corroborated.

No ransom demand, deadline, or negotiation status has been publicly disclosed. Court Square Group has not issued a public statement confirming or denying the claim as of this report.

Threat Actor Profile

Black X is a relatively obscure ransomware operation with no established public track record that Yazoul Security researchers can currently verify. Key intelligence gaps include:

• Total known victims: Unknown. The group’s leak site history has not been independently catalogued.
• Known tools and tactics: No publicly documented toolset, initial access vector, or malware family has been attributed to Black X with confidence. The group’s claimed use of cloud-environment exfiltration (RegDocs365, ARCC) is asserted only by the actor itself and remains unverified.
• Research references: No peer-reviewed or vendor research is publicly available on this group at the time of writing.

Because the group lacks a documented history, its credibility cannot be assessed against prior behavior. Groups with thin or nonexistent track records sometimes exaggerate data volumes and victim sensitivity to manufacture leverage. The absence of published samples, combined with a promise to share file lists “in the next few days,” is consistent with either a genuine intrusion or a bluff designed to force contact.

Alleged Data Exposure

According to the threat actor, the purported 3TB dataset includes:

• Clinical trial data
• Research materials
• Various customer reports tied to RegDocs365 and ARCC

Yazoul Security has not seen, reviewed, or validated any of this data. The specific data volume is otherwise undisclosed beyond the actor’s own 3TB figure. No samples, file listings, credentials, or download references are included in this report by policy.

Potential Impact

If the claim is accurate, the exposure of clinical trial and research data could carry significant regulatory, contractual, and reputational consequences, particularly given healthcare-adjacent data handled within a financial services context. Customers of RegDocs365 and ARCC could face notification obligations depending on jurisdiction and data type. However, all of this remains speculative until the organization or independent investigators confirm a breach.

What to Watch For

• Whether Black X publishes the promised file list, and whether the files are verifiable and current.
• Any official statement from Court Square Group or its regulators.
• Indicators of cloud-tenant compromise, such as anomalous API access or bulk export activity in RegDocs365 and ARCC environments.
• Whether the group escalates with deadlines or sample dumps, a pattern typical of pressure campaigns.

No YARA rules or detection guidance specific to Black X are publicly available at this time. Organizations should rely on general cloud exfiltration monitoring and identity anomaly detection.

Disclaimer

This report is based solely on an unverified claim posted to a ransomware leak site. Nothing herein is confirmed. Yazoul Security has not independently verified the intrusion, the data volume, the data contents, or the actor’s identity. Ransomware groups routinely exaggerate claims to pressure victims. Treat all statements as allegations until corroborated by the affected organization or independent forensic investigation.