Black Basta claims data breach against gai-it.com

• Ransomware group: Black Basta
• Country: Italy
• Sector: Technology
• Announcement date: May 4, 2024

The Black Basta ransomware group has listed the Italian-based technology company gai-it.com on its leak site. According to the group's announcement, they claim to have successfully exfiltrated approximately 750 GB of data from the organization.

Details of the claimed attack

The announcement made by the Black Basta group suggests that the compromise of the company's data occurred on April 18, 2024. The group's listing, which was posted on May 4, 2024, claims that the breach involved the theft of sensitive information from the organization's systems.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. These sites serve as a public gallery where threat actors post the names of targeted organizations and, in many cases, samples of the stolen data. This practice is a central component of modern cyber extortion, where the threat of public exposure is used as leverage against the victim.

Data involved in the incident

The Black Basta group claims that the stolen information includes a variety of sensitive files. According to the group's claims, the exfiltrated data consists of the following types of information:

• Employee personal documents
• Corporate data
• Project files

The volume of the data claimed to be stolen is approximately 750 GB. While the specific file count was not provided in the announcement, the group asserts that the breach encompasses critical internal documentation and personal records belonging to the workforce.

About gai-it.com

Gai is an Italian-based company that has been manufacturing high-quality bottling and labeling machines for wine, beer, spirits, and oily liquids for over 70 years. Operating globally, the company provides technical support and spare parts services for bottling operations.

Potential implications and defensive considerations

If the claims made by the Black Basta group are verified, the exposure of employee personal data could create significant risks, including identity theft and the potential for targeted phishing attacks against the staff. Furthermore, as the organization is based in Italy, the incident could lead to legal and administrative sanctions under the EU General Data Protection Regulation (GDPR).

Black Basta has reported ties to the Conti group, and it is possible that the threat actor may employ double-extortion tactics. Double extortion is a method where attackers not only encrypt a victim's data but also steal it, threatening to leak the sensitive information on a public forum if the ransom is not paid. This increases the pressure on the organization, as the threat of a data leak remains even if the company can restore its systems from backups.

The incident could lead to negative impacts on the company's operational continuity and commercial reputation. For organizations operating in the technology and manufacturing sectors, maintaining robust data security measures is vital to prevent such exposures. Common defensive steps include implementing strict access controls, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.