Black Basta claims data breach at numotion.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Healthcare
• Announcement date: April 9, 2024

The Black Basta ransomware group has listed numotion.com on its leak site, claiming to have exfiltrated approximately 2 TB of data from the healthcare technology provider. This announcement, made on April 9, 2024, follows a claimed attack date of March 2, 2024, marking a significant potential breach for the US-based organization.

The details of the alleged claim

According to the announcement posted by the Black Basta group, the threat actors claim to have successfully compromised the network of numotion.com. The group alleges that they have obtained a massive volume of information, estimated at approximately 2 TB. As part of their threat, the group has stated their intention to publish the stolen information on their platform.

In such cyberattacks, ransomware groups often utilize a method known as double extortion. In this tactic, attackers do not merely encrypt a victim's systems to demand a ransom for decryption; they also steal sensitive data before the encryption process begins. This allows them to threaten the victim with the public release of confidential information if the ransom is not paid, creating additional pressure on the organization. This method increases the leverage held by the attackers and significantly heightens the risk to the victim's stakeholders.

Data types involved in the alleged leak

The announcement provided by the group included a list of folders and document categories that purportedly belong to the organization. While the specific file count was not disclosed, the group claims the stolen data is highly sensitive. The information allegedly exfiltrated includes a variety of administrative and personal records, such as:

• Human resources records
• Payroll data
• Financial data
• Personal user data
• Legal documents

The presence of such diverse data types suggests that the attackers may have gained access to various internal systems used for business operations and personnel management.

The organization profile

Numotion is a US-based healthcare company that provides personalized rehabilitation technology, wheelchairs, and assistive health products for individuals with mobility limitations. Aiming to increase the independence of individuals with disabilities in daily life, the company works in collaboration with clinicians and health plans.

Implications and industry considerations

This alleged breach may pose significant risks of identity theft and fraud for both employees and individuals receiving services from numotion.com. Given the organization's role in the healthcare sector, the exposed data could fall under regulations such as HIPAA, potentially leading to regulatory scrutiny and legal consequences. The potential exposure of personal and financial information creates a high-risk environment for all parties involved.

Furthermore, the incident may negatively impact the organization's operational continuity and customer trust, while also potentially affecting supply chain partners. When sensitive data is leaked, it can be utilized in targeted phishing campaigns, where attackers use the stolen information to craft convincing messages to trick individuals into revealing even more credentials or funds.

For organizations operating within the healthcare sector, maintaining robust cybersecurity postures is critical to protecting sensitive patient and employee information. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Because Black Basta is a known threat actor, organizations must remain vigilant against their specific tactics. Information regarding this group remains limited, but their involvement highlights the ongoing threat posed to healthcare technology providers.