Black Basta claims to have stolen data from dasteam.ch

• Ransomware group: Black Basta
• Country: Switzerland
• Sector: Professional Services
• Announcement date: February 21, 2024

Black Basta claims a data breach at dasteam.ch

The Black Basta ransomware group has published a claim on its leak site involving the Swiss-based company dasteam.ch. According to the announcement made on February 21, 2024, the threat actor group claims to have exfiltrated a significant volume of data belonging to the organization.

The group has listed the data allegedly belonging to dasteam.ch on its leak portal. To support their claim, the group provided categorical information regarding the content of the alleged leaked data through a screenshot. The total size of the data claimed to be stolen is 202 GB. The announcement of this alleged incident occurred on February 21, 2024, which coincides with the date the group claims the attack took place.

Details of the alleged data theft

The information provided in the group's announcement outlines several categories of sensitive information that have allegedly been compromised. While the specific file count and the exact ransom demand were not provided in the announcement, the nature of the content suggests a broad impact on the organization's internal and external records. The allegedly leaked data includes the following types of information:

• Customer data
• HR records
• Accounting records
• Personal documents

In the context of modern cyberattacks, such leaks are often part of a double-extortion tactic. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive data to threaten its public release. This pressure is used to coerce the victim into paying a ransom to prevent the exposure of their private information.

About dasteam.ch

Das Team AG is a Swiss-based company that provides personnel leasing and recruitment services. The firm operates across several key sectors, including construction, craft, industry, technical, and medical industries. Since its establishment in 1987, the company has offered professional staffing solutions through its team of qualified consultants.

Potential risks and organizational implications

This alleged leak by the Black Basta group may pose secondary risks, such as identity theft or targeted phishing attacks, against the company's employees and customers. Because the data includes human resources and personal documents, the risk to individuals within the organization's ecosystem is heightened. Furthermore, because the company is based in Switzerland, the incident may lead to legal consequences under the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR).

The group's reported ties to Conti suggest that these attacks are conducted with professional motivation. Such sophisticated actors often focus on high-impact data to maximize their leverage during negotiations. For organizations in the professional services sector, such incidents can lead to negative impacts on operational continuity and reputation management.

To mitigate the risks associated with such breaches, organizations are generally advised to review their data security measures. This includes implementing robust access controls, enhancing monitoring capabilities to detect unauthorized data movement, and ensuring that sensitive records are encrypted both at rest and in transit. Maintaining a comprehensive incident response plan is also essential for managing the legal and reputational fallout of a potential data exposure.