Black Basta claims to have stolen data from cinfab.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Manufacturing
• Announcement date: January 23, 2024

Black Basta lists data allegedly belonging to cinfab.com

The Black Basta ransomware group has listed data allegedly belonging to cinfab.com on its leak site. According to the announcement made on January 23, 2024, the group claims to have exfiltrated a total of 1.1 TB of data belonging to the organization.

The group's announcement indicates that the organization was targeted in December 2023. This timeline suggests that the breach may have occurred several weeks before the public listing on the leak site. No information was provided regarding a ransom demand or the specific file count involved in the incident.

Details of the alleged data breach

According to the information provided in the announcement, the allegedly leaked data includes a variety of sensitive information. The group's claim suggests that the stolen data consists of the following types of files:

• Employee files
• Users' personal folders
• Budget documents
• Project files

The announcement included screenshots that appear to display various technical documents and project names, which seem to originate from file directories within the organization's network. This visual evidence is intended to support the group's claims regarding the scope of the exfiltration.

About cinfab.com

CINFAB is a contractor specializing in sheet metal fabrication and installation for commercial HVAC systems. Founded in 1981, the company provides comprehensive services that cover the entire lifecycle of their projects, including the design, manufacturing, and installation processes.

Risk assessment and implications

This action by the Black Basta group may create secondary risks such as identity theft and targeted phishing attacks for the organization's employees and customers. Because the group is assessed to have links to Conti, it may be observed that the attacks are conducted using double-extortion methods. In a double-extortion scenario, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it publicly if a ransom is not paid.

As the organization is based in the United States, state-level data breach notification laws and relevant regulations may be triggered depending on the nature of the leaked data. The organization's operational continuity and commercial reputation may be negatively affected depending on the sensitivity of the published data.

The Black Basta group, which emerged in early 2022, follows an active methodology regarding infiltration into corporate networks. For organizations in the manufacturing sector, such attacks highlight the importance of robust network segmentation and strict access controls to prevent unauthorized movement within the environment. Furthermore, maintaining comprehensive logging and monitoring can help in detecting the exfiltration of large volumes of data, which in this case was claimed to be 1.1 TB.