Black Basta claims data breach against keystonetech.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Technology
• Announcement date: March 12, 2024

Black Basta claims data breach against keystonetech.com

The Black Basta ransomware group has listed data allegedly belonging to Keystone Technologies on their leak site. According to the threat actor, the group claims to possess approximately 550 GB of information stolen from the organization.

Details of the claimed attack

The Black Basta group has listed data on their leak site, which they claim was obtained during an incident that reportedly occurred on 2024-02-29. The group asserts that they possess approximately 550 GB of data, which includes various sensitive files from different departments. The threat actor is threatening to publicly release the institution's operational and personal data if their demands are not met.

Ransomware leak sites like the one used by Black Basta are a central component of modern double extortion tactics. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to release this data publicly, the attackers aim to maximize pressure on the victim, often targeting the organization's reputation and legal standing.

Scope of the allegedly stolen data

The announcement specifies the inclusion of various types of sensitive information. The group claims to have access to files from the accounting and financial departments, as well as HR department files and user folders. The specific categories of data mentioned in the listing include:

• Accounting records
• Financial data
• HR data
• IT records
• Employee personal documents

The exposure of such a wide variety of data—ranging from internal IT records to personal employee documents—presents a significant challenge for the target organization. When attackers gain access to internal documentation and financial records, they gain a roadmap of the organization's internal processes and vulnerabilities.

Potential impact and risks

The allegedly exfiltrated data may pose secondary risks such as identity theft and targeted phishing attacks for the institution's employees and stakeholders. Because the data includes personal documents and HR information, individuals within the organization may become targets for social engineering attempts that leverage the stolen personal details to gain further trust.

As the institution is based in the US, data breach notification obligations under relevant state laws and federal regulations may arise. The exposure of financial and HR data could create pressure on the institution's commercial reputation and legal compliance processes. Furthermore, given that the Black Basta group is assessed to have ties to Conti, negative impacts on the institution's operational continuity may be observed.

Considering the group's methods, it is possible that the leaked data may lead to wider leaks or further extortion attempts in the future. Organizations facing such threats often prioritize incident response, forensic investigation, and strengthening their defensive postures to mitigate the impact of such breaches. General defensive steps for organizations typically involve implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to defend against the phishing attacks that often follow such leaks.