Black Basta claims to have exfiltrated data from dgse.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Professional Services
• Announcement date: March 27, 2024

Black Basta lists dgse.com on leak site

The Black Basta ransomware group has listed dgse.com on its leak site, claiming to have exfiltrated approximately 350 GB of data. This announcement, made on March 27, 2024, follows an alleged attack date of March 5, 2024. The group is using the publication of this data as a method to exert pressure on the targeted organization.

Details of the alleged data breach

According to the claims made by the Black Basta group, the breach involves a significant volume of information. The group alleges that they have compromised the organization's data, specifically targeting a dataset that is approximately 350 GB in size. This alleged dataset is said to contain both operational and personal information. Screenshots provided by the group appear to display directory structures that contain various types of sensitive files.

The specific types of data mentioned in the listing include:

• Personal user confidential documents
• Company data
• Accounting records

While the group has published these claims, no ransom demand has been specified in the available information.

About Dallas Gold & Silver Exchange

The target of this alleged attack is dgse.com, known as Dallas Gold & Silver Exchange (DGSE). The company has been operating for over four decades in the buying and selling of precious metals. Furthermore, the organization is involved in the retailing of diamonds, fine jewelry, and luxury watches. Based in Texas, the company specializes in the trade of precious goods within the region.

Risk assessment and organizational impact

The alleged exfiltration of data poses several secondary risks. For both employees and customers, the breach could lead to identity theft and the occurrence of targeted phishing attacks. Because the organization is based in the United States, this potential breach may trigger legal proceedings under various state laws and federal regulations.

The Black Basta group, which emerged in early 2022, is assessed to have links to Conti. Due to these connections, the group may be inclined to employ double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's data but also steal it, threatening to leak the sensitive information on a public leak site if the ransom is not paid. This tactic increases the pressure on an organization, as the threat of a data leak can cause significant damage to business operations and customer trust.

For organizations operating in the professional services sector, maintaining robust cybersecurity defenses is critical to mitigating such risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security awareness training to prevent phishing. As the public information regarding the Black Basta group remains limited, organizations must remain vigilant against the evolving tactics used by such threat actors.