Black Basta claims to have exfiltrated data from dilweg.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Professional Services
• Announcement date: February 22, 2024

Black Basta claims data theft from dilweg.com

The Black Basta ransomware group has listed dilweg.com on their leak site, claiming to have exfiltrated approximately 453 GB of data. This announcement, which was made on February 22, 2024, suggests that the organization's data has been compromised. The group claims the attack occurred on February 8, 2024.

Details of the alleged breach

According to the claims made by the Black Basta group, the stolen dataset is approximately 453 GB in size. The group alleges that this information is related to the operational processes of the organization. While the group has published this listing on their leak site, no information was provided regarding a ransom demand.

The announcement specifies that the following types of data are present in the alleged leak:

• Financial data
• Scans
• Accounting records (QuickBooks)
• Personal user files
• OneDrive data

About Dilweg

Dilweg is an investment and management firm focused on middle-market real estate assets in major metropolitan areas across the Southeastern United States. The company provides a wide range of real estate services, including asset enhancement, property management, construction management, and brokerage.

Analysis and potential impact

The nature of the allegedly exfiltrated data may pose secondary risks such as identity theft or targeted phishing attacks for the organization's employees and clients. Given that the entity is based in the US, the breach may have implications regarding state-level data protection laws and potential regulatory scrutiny. The disclosure of this data may have negative impacts on the organization's commercial reputation and operational security.

The Black Basta group's past activities suggest they employ double-extortion tactics, aiming to exert pressure by publicly releasing stolen data. This group, which emerged in early 2022 and is assessed to have links to the Conti group, has been observed to be active in infiltrating corporate networks. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's systems but also steal sensitive information, threatening to leak it on public forums if a ransom is not paid. This method increases the pressure on organizations to comply with demands.

For organizations operating in the professional services and real estate sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee training to recognize phishing attempts. Furthermore, monitoring for unauthorized data exfiltration and ensuring strict access controls can help mitigate the risks associated with sophisticated threat actors like Black Basta.