Black Basta claims data breach against hpecds.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Technology
• Announcement date: July 15, 2024

Black Basta claims data breach against hpecds.com

The Black Basta ransomware group has listed hpecds.com on its leak site, claiming to have exfiltrated approximately 500 GB of data. This announcement, made on July 15, 2024, targets the technology sector and involves a subsidiary of Hewlett Packard Enterprise.

Details of the alleged attack

According to the claims made by the Black Basta group, the alleged breach occurred on June 14, 2024. The threat actors assert that they successfully accessed the organization's network and obtained a significant volume of information. Specifically, the group claims to have exfiltrated approximately 500 GB of data from the victim's infrastructure.

Ransomware groups often utilize leak sites to exert pressure on their victims through double-extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten public disclosure. This method aims to maximize the pressure on the victim to pay the ransom by leveraging the potential reputational and legal consequences of a data leak.

Alleged compromised data

The information allegedly stolen by the threat actors is described as highly sensitive. The group claims that the leaked data contains a wide variety of corporate and personal information. The specific types of data mentioned in the claim include:

• Company data
• Human resources data
• Hiring data
• Personal employee documents
• Client data
• Project files

The presence of such diverse data types, ranging from internal project files to personal employee documents, highlights the potential impact of such an incident on both the organization and the individuals involved.

Organization profile

The target of this alleged attack, hpecds.com, is CDS (Hewlett Packard Enterprise CDS). This company is a wholly owned subsidiary of Hewlett Packard Enterprise. CDS provides a range of specialized services, including multi-vendor support, on-site technical services, and customized IT solutions to customers within the EMEA region.

Risk assessment and implications

The claim published by the Black Basta group may pose significant risks to the organization's operational continuity and data privacy. Given the sensitivity of the alleged data, secondary risks such as identity theft or targeted phishing attacks against employees and customers may emerge. Because the organization is based in the United Kingdom, a potential data breach could trigger legal obligations and administrative sanctions under UK GDPR.

Black Basta, which emerged in early 2022 and is assessed to have links to the Conti group, is known to frequently employ double-extortion tactics. While public information about this group remains limited, it is assessed that such leaks could negatively impact supply chain security, especially when the target is a service provider for other businesses.

For organizations operating in the technology and service sectors, maintaining robust security postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees to defend against phishing. Furthermore, ensuring comprehensive data encryption and maintaining offline, immutable backups can help protect against the disruptive effects of ransomware and the threat of data exfiltration.