Black Basta claims to have stolen data from haes.ca

• Ransomware group: Black Basta
• Country: Canada
• Sector: Healthcare
• Announcement date: January 23, 2024

The Black Basta ransomware group has listed a significant amount of data allegedly belonging to the energy services provider haes.ca on their leak site. According to the announcement made on January 23, 2024, the group claims to have obtained 345 GB of data from the organization.

The claimed attack and event details

The Black Basta group has listed data belonging to haes.ca on their leak site. The announcement claims that files related to the organization's human resources, finance, and governance processes have been obtained. The group alleges that this incident occurred in December 2023, targeting the organization's operational data.

Ransomware groups often use leak sites to pressure victims into paying ransoms by threatening to release sensitive information. This tactic is a cornerstone of double extortion, a method where attackers not only encrypt a victim's systems but also steal sensitive data to use as leverage during negotiations. By publishing a portion of the stolen data or simply announcing its theft, the group aims to maximize the reputational and operational damage to the target.

The scope of the alleged data breach

The information allegedly stolen by the Black Basta group includes a variety of sensitive documents. The group claims to have access to files related to several critical business functions. The specific types of data mentioned in the claim include:

• Human resources data
• Financial records
• Governance documents
• Project files

The exposure of such diverse datasets—ranging from administrative and financial records to specific project files—suggests a broad intrusion into the organization's internal systems. When such data is leaked, it can lead to various secondary risks, including the potential for identity theft or highly targeted phishing attacks directed at the organization's employees and management personnel.

About High Arctic Energy Services

High Arctic Energy Services is an energy services provider that offers drilling, well completion services, and rental equipment in Papua New Guinea and Western Canada. The company specializes in providing drilling support equipment and pressure control systems to oil and gas exploration and production companies.

Assessment and industry implications

It is assessed that the allegedly leaked data may facilitate identity theft or targeted phishing attacks against the organization's employees and management. Because the organization is based in Canada, the breach may lead to legal consequences under local data protection regulations such as PIPEDA. The exposure of operational data could pose secondary risks regarding trade secrets and supply chain security.

The Black Basta group, which emerged in early 2022, is known to actively utilize double extortion tactics. Furthermore, the historical ties of the Black Basta group to Conti suggest that their attack methods may be sophisticated. This complexity highlights the evolving nature of ransomware threats facing critical infrastructure and service providers.

For organizations operating in the energy and industrial services sectors, such incidents underscore the importance of robust cybersecurity frameworks. Common defensive steps for organizations facing these threats include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent phishing. Additionally, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws are vital components of a modern defense strategy.