Black Basta claims data breach at ssmnlaw.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Professional Services
• Announcement date: February 13, 2024

Black Basta targets ssmnlaw.com in alleged data exfiltration

The Black Basta ransomware group has listed ssmnlaw.com on their leak site, claiming to have exfiltrated a significant volume of data from the organization. According to the announcement made on February 13, 2024, the threat actors claim to have compromised a total of 401 GB of information belonging to the entity.

The group's announcement alleges that the data was discovered on February 13, 2024. Through this listing, the ransomware group has threatened to release the stolen information publicly. This type of activity is a hallmark of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage for ransom demands.

Details of the alleged data theft

The claims made by Black Basta suggest that the exfiltrated data is highly sensitive and covers various aspects of the organization's operations. The group alleges that the compromised information includes business processes, financial records, and personnel information. This type of data is particularly valuable to threat actors due to its potential for misuse in various fraudulent activities.

According to the announcement, the specific types of data involved include:

• Financial records
• Human resources data
• Payroll information
• Business documents

The group also claims that the stolen content encompasses accounting records, budgeting documents, and user shared folders, indicating a broad reach into the organization's digital environment.

About Sanford, Pierson, Thone & Strean, PLC

The target of this alleged attack, ssmnlaw.com, is identified as Sanford, Pierson, Thone & Strean, PLC. This is a law firm based in Minnesota. The firm provides professional legal services in several specialized areas, including business law, litigation, estate planning, and real estate law.

Impact and security implications

The alleged exfiltration of data from a law firm may pose significant risks regarding client confidentiality and the exposure of sensitive personal information. Because the institution is based in the United States, the breach may trigger data breach notification obligations under relevant state laws and federal regulations.

The presence of human resources and payroll data within the alleged leak increases the risk of identity theft and targeted phishing attacks against employees. When sensitive personal and financial information is exposed, individuals within the organization often become targets for subsequent social engineering campaigns.

Black Basta is a Ransomware-as-a-Service (RaaS) group that emerged in early 2022. The group is assessed to have links to the Conti group, and it is noted that the group's internal communications were leaked in early 2025. Organizations facing such threats may need to verify the actual content of any leaked data and implement necessary security measures to protect affected parties.

In general, organizations in the professional services sector can take several defensive steps to mitigate the impact of such attacks. This includes implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to help employees recognize phishing attempts. Furthermore, monitoring for unauthorized data exfiltration and maintaining strict access controls for sensitive folders can help reduce the likelihood of a successful large-scale data theft.