Black Basta claims data breach against DEUTSCHELEASING

• Ransomware group: Black Basta
• Country: Switzerland
• Sector: Financial Services
• Announcement date: August 17, 2023

Black Basta targets DEUTSCHELEASING in alleged data breach

The Black Basta ransomware group has listed DEUTSCHELEASING on its dedicated leak site, alleging that the institution has suffered a data breach. This announcement, made on August 17, 2023, marks a new development in the group's ongoing targeting of corporate entities. The claim suggests that sensitive information belonging to the organization has been exfiltrated by the threat actors.

Details of the alleged attack

According to the announcement posted by the Black Basta group, the institution was added to their target list on August 17, 2023. The group's post claims that they have successfully exfiltrated data belonging to the organization. Furthermore, the threat actors have issued a threat, suggesting that the mentioned data may be published on the internet if their specific demands are not met by the organization.

Regarding the specific nature of the information involved in this incident, the current record provides no information regarding the nature of the leaked or threatened data. Additionally, the listing names no specific data types. While screenshots were reviewed during the investigation, the leak site itself was observed to be returning an access error, and no further details regarding the volume of data or the specific files involved were provided in the available documentation.

About DEUTSCHELEASING

DEUTSCHELEASING is a Germany-based financial institution that specializes in providing asset finance and leasing solutions. The company serves small and medium-sized enterprises by offering investment and financing support across a variety of sectors. Their service portfolio includes financing for machinery, vehicle fleets, real estate, and various IT projects.

Risk assessment and industry implications

This allegation against DEUTSCHELEASING may pose a significant risk of exposing customer and employee data, particularly given the sensitive nature of the institution's operations within the financial services sector. Because the organization operates based in Switzerland and Germany, a potential data breach could trigger complex legal processes under the General Data Protection Regulation (GDPR) and other relevant local data protection regulations.

The Black Basta group is known for employing double-extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems but also steal sensitive data to use as leverage. By threatening to leak the information publicly, they increase the pressure on the victim to pay the ransom. This group has shown a pattern of being active in infiltrating corporate networks to achieve these goals. Such a leak, if verified, could lead to substantial reputational damage and a significant loss of trust among the institution's customers.

For organizations operating in the financial services sector, such threats underscore the necessity of robust cybersecurity postures. Common defensive measures include maintaining strict access controls, implementing multi-factor authentication, and ensuring comprehensive monitoring of network traffic to detect unauthorized exfiltration. As public information regarding the specific methods of the Black Basta group remains limited, organizations must remain vigilant against these sophisticated extortion-based threats.