BlackFile is an active extortion group targeting retail and hospitality organizations by calling employees, impersonating IT helpdesk staff, and tricking them into approving login requests or registering attacker-controlled devices. Once inside, the group uses legitimate Salesforce and SharePoint API functions to steal customer and operational data, then demands seven-figure payments under threat of public disclosure. Palo Alto Unit 42 and Mandiant have been engaged in active incident response against BlackFile campaigns, making this an operationally live threat requiring immediate identity and access controls review.