Black Basta claims to have stolen data from pdq-airspares.co.uk

• Ransomware group: Black Basta
• Country: United Kingdom
• Sector: Transportation
• Announcement date: April 1, 2024

The Black Basta ransomware group has listed approximately 500 GB of data allegedly belonging to pdq-airspares.co.uk on their leak site. This announcement, made on April 1, 2024, follows a claimed attack date of February 29, 2024.

The details of the alleged breach

The threat actor known as Black Basta has published a leak announcement claiming to have compromised data belonging to pdq-airspares.co.uk. According to the group's claims, the breach involves a significant volume of information, with the total volume of the compromised data stated to be approximately 500 GB.

In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The attackers then threaten to leak this stolen data on public forums or dedicated leak sites if the ransom demand is not met. This method increases the pressure on the victim by threatening their reputation and legal standing through the exposure of private information.

The Black Basta group has been active since early 2022 and is assessed to have potential links to the Conti group. It is worth noting that the recent leak of the group's internal communications may lead to changes in their operational tactics, potentially altering how they conduct these types of extortion-based attacks in the future.

Data types and content involved

The announcement mentions the presence of corporate data and personal user documents. Based on the information provided in the leak announcement, the following types of data are allegedly involved:

• Corporate data
• Personal user documents

The content of the leak is further illustrated by screenshots provided by the threat actor. These screenshots display folder names related to Air Mauritius, EirTrade Certs, and various sales documentation, suggesting the scope of the files contained within the alleged breach.

About pdq-airspares.co.uk

PDQ Airspares is a global provider of aerospace consumables for the airline and MRO (maintenance, repair, and overhaul) markets. Based in the UK, the company offers a range of logistics and product solutions for operational requirements.

Potential impact and organizational risks

The alleged leak may pose risks to the institution's operational continuity and data privacy. For an entity operating in the UK, legal sanctions and notification obligations under UK GDPR may arise. The exposure of sensitive information can lead to significant regulatory scrutiny and the need for complex compliance procedures to address the breach of privacy.

Furthermore, it is possible that the allegedly compromised data could be used for identity theft or targeted phishing attacks against employees and customers. When personal user documents are leaked, attackers often use the information to craft highly convincing social engineering campaigns, making it difficult for individuals to distinguish between legitimate communications and fraudulent ones.

For organizations operating in critical sectors like transportation and aerospace, maintaining robust cybersecurity posture is essential. Defensive strategies typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security awareness training to help employees recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and maintaining strict access controls can help mitigate the impact of such incidents. As threat actors continue to evolve, organizations must remain vigilant against the shifting tactics of groups like Black Basta.