Ampersand.tv listed on Black Basta ransomware leak site

• Ransomware group: Black Basta
• Country: United States
• Sector: Technology
• Announcement date: November 1, 2023

Black Basta claims data breach at ampersand.tv

The Black Basta ransomware group has listed the United States-based technology company ampersand.tv on its dedicated leak site. This announcement, which occurred in the final quarter of 2023, involves a claim that the organization's data has been compromised. While the group has published a listing, the specific details regarding the total volume of stolen files and the exact ransom demand have not been disclosed in the announcement.

The claim involves a breach that the group alleges took place on September 28, 2023. In such ransomware operations, threat actors often employ a double extortion tactic. This method involves not only encrypting an organization's internal systems to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to leak this information on a public forum, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or sensitive information.

Details of the alleged data leak

According to the information provided by the Black Basta group, the leaked content includes various documents that appear to be related to the operational processes of ampersand.tv. The group has provided screenshots to support their claims, which show samples of documents that could potentially impact the company's business relationships and internal workflows. The specific types of data identified in the listing include:

• Business partner contact information
• Non-disclosure agreements
• Operational network data

The presence of signed non-disclosure agreements and partner contact details suggests that the breach may have access to information that is sensitive to the company's external professional relationships.

About ampersand.tv

Ampersand is a technology company headquartered in the United States that operates within the technology sector. The company functions as a data-driven TV advertising sales and technology provider. Its core business model involves providing viewership insights and advertising planning services. It achieves this by reaching multiscreen households across a wide variety of both local and national television networks.

Risk assessment and industry implications

The potential exposure of this data carries significant risks for the organization. The leak may cause damage to the company's commercial operations and could undermine the trust established with its business partners. Because ampersand.tv is a US-based entity, the company may face scrutiny under state-level data protection laws and could face potential legal repercussions resulting from the incident.

Beyond the immediate operational and legal concerns, there are secondary risks associated with this type of breach. The leaked data could potentially be utilized by malicious actors for identity theft or to facilitate targeted phishing attacks against the company or its partners. Such attacks often leverage the stolen contact information to increase the credibility of fraudulent communications.

The Black Basta group is a Ransomware-as-a-Service (RaaS) operation that has been active since early 2022. The group has reported links to the Conti group. Although there have been reports that the group's internal communications were previously leaked, it is assessed that their threat potential remains relevant in the current cyber threat landscape. For organizations in the technology and advertising sectors, maintaining robust defensive measures is critical. This includes implementing strict access controls, conducting regular security audits, and ensuring that data protection protocols are strictly followed to mitigate the impact of potential exfiltration events.