Black Basta claims data breach at rockportmortgage.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Financial Services
• Announcement date: November 19, 2024

Black Basta claims data breach at rockportmortgage.com

The Black Basta ransomware group has listed Rockport Mortgage on its leak site, claiming to have exfiltrated approximately 1.1 TB of data. This announcement, made on November 19, 2024, marks a significant escalation in the threat posed to the organization by the ransomware group.

Details of the alleged attack

According to the claims made by the Black Basta group, the threat actors gained access to the organization's network on October 5, 2024. The group asserts that they have successfully exfiltrated a large dataset containing sensitive financial and personal information. Following the initial access, the group has threatened to publish this data on their leak site if their demands are not met.

Ransomware groups often utilize a tactic known as double extortion. In this scenario, the attackers do not merely encrypt the victim's files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release confidential data publicly, the attackers aim to increase the pressure on the organization to pay the ransom, leveraging the threat of reputational damage and legal consequences.

Alleged data contents

The group claims to have obtained a wide variety of sensitive files. The alleged leaked data includes a range of documents that could impact both the company and its stakeholders. The specific types of data mentioned in the claim include:

• Employee personal documents
• Financial data
• Accounting records
• Payroll data
• User personal folders
• Customer data
• Tax records

The nature of these files suggests a high level of sensitivity, as they encompass private information belonging to both the workforce and the client base of the institution.

Organization profile

Rockport Mortgage is a national financial institution that provides FHA-insured financing programs. The organization offers customized solutions for multifamily housing, as well as healthcare and assisted living facilities.

Impact and risk assessment

The claims made by the Black Basta group may pose significant secondary risks, such as identity theft and targeted phishing attacks, for the organization's employees and customers. Because the alleged leaked data is heavily focused on financial and tax-related information, the organization could face legal repercussions under relevant US state laws and federal regulations.

Beyond the immediate operational disruptions, the organization may face significant reputational damage. The financial and tax-related nature of the data increases the potential for long-term consequences for the victims whose information may have been compromised. While the leak of the group's internal communications in early 2025 may cause shifts in their operational structure, it is assessed that the threat level from Black Basta may remain high.

For organizations operating within the financial services sector, such incidents highlight the necessity of robust defensive measures. Common defensive steps often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training to mitigate the risk of initial access. Furthermore, maintaining offline, immutable backups and implementing strict network segmentation can help limit the lateral movement of attackers and the scope of data exfiltration during a breach.