Black Basta claims to have stolen data from mjcelco.com

• Ransomware group: Black Basta
• Country: United States
• Sector: Manufacturing
• Announcement date: March 27, 2024

The Black Basta ransomware group has listed approximately 1.2 TB of data on its leak site, which the group alleges belongs to the United States-based manufacturing company mjcelco.com. The announcement, made on March 27, 2024, suggests that the group gained unauthorized access to the company's internal systems around March 19, 2024.

The details of the alleged breach

According to the claims made by the Black Basta group, the attackers successfully compromised sensitive information belonging to mjcelco.com. The group has published this data on their dedicated leak platform to exert pressure on the organization. The announcement states that the group gained access to various critical areas within the company, including its production processes, financial records, and personal folders belonging to employees.

The group alleges that the total volume of the compromised data is approximately 1.2 TB. While the group has provided screenshots that show examples of the organization's file directory structure, they have not provided information regarding a specific ransom demand. The group's method involves the use of double extortion tactics, a strategy where attackers not only encrypt a victim's data but also threaten to leak sensitive information publicly to maximize pressure on the target organization.

The types of data involved in the claim

The information released by the group suggests that the breach may involve a wide range of sensitive corporate and personal documentation. Based on the announcement, the data potentially includes various critical assets that are vital to the company's operations and its workforce. The specific categories of data mentioned in the claim include:

• Engineering drawings
• Financial data
• Employee personal data

The exposure of such diverse data types—ranging from technical intellectual property to private employee information—highlights the broad scope of the alleged intrusion into the company's digital environment.

About mjcelco.com

MJ Celco is a company operating in the metal stamping and fabrication industry. Based in Schiller Park, Illinois, the firm provides metal processing and manufacturing services for various industries. As an organization involved in specialized manufacturing and metal processing, the company maintains various technical and financial records essential to its industrial operations.

Analysis and potential implications

Black Basta is a Ransomware-as-a-Service (RaaS) group that has been active since early 2022. The group is assessed to have links to the Conti group. This specific leak may pose significant secondary risks for the employees of mjcelco.com, such as the potential for identity theft and targeted phishing attacks. Furthermore, the exposure of the company's financial and engineering data could potentially lead to negative impacts on trade secrets and the organization's competitive advantage in the manufacturing sector.

Because the organization operates within the United States, the breach may trigger legal obligations. Specifically, data breach notification requirements under relevant state laws and federal regulations may arise depending on the nature of the compromised data. In general, when organizations face such threats, they must manage the complexities of regulatory compliance and the protection of intellectual property.

For organizations in the manufacturing sector, such incidents underscore the importance of robust cybersecurity frameworks. Protecting engineering drawings and proprietary production processes is critical for maintaining a competitive edge. Additionally, securing financial records and employee data is essential to prevent the secondary harms of identity theft and targeted social engineering attacks. As seen in this case, the use of double extortion by groups like Black Basta necessitates a comprehensive approach to data protection and incident response.