Black Basta claims to have stolen data from Swiss retailer fcw.ch

• Ransomware group: Black Basta
• Country: Switzerland
• Sector: Technology
• Announcement date: February 29, 2024

Black Basta claims a major data breach at fcw.ch

The Black Basta ransomware group has listed a significant amount of data on its leak site, claiming that the information belongs to the Swiss organization fcw.ch. According to the group's announcement, the stolen data totals approximately 705 GB. This claim suggests that the threat actors managed to access and extract a substantial volume of information from the organization's networks.

The group has officially initiated a process regarding the potential publication of this data. This type of announcement is a common tactic used by ransomware groups to pressure victims. By listing the organization on their leak site, these groups aim to create public visibility and urgency, often as part of a broader extortion strategy.

Details of the alleged data theft

The information provided by the threat actor indicates that the breach involves a wide variety of sensitive files. The group claims to have obtained access to various internal directories and documents that could contain highly sensitive information. Based on the announcement, the data allegedly includes:

• Personal employee data
• Company data
• Accounting records
• HR data

Furthermore, the group has provided visual evidence in the form of screenshots. These screenshots reportedly display folder structures specifically related to the accounting and purchasing departments of the organization, suggesting a deep level of access into the company's internal administrative and financial operations.

About Franz Carl Weber

Franz Carl Weber is a prominent figure in the Swiss retail landscape. As one of Switzerland's leading toy retailers, the company boasts a long history spanning over 140 years. It is recognized as one of the oldest toy brands in the world, maintaining a comprehensive range of children's toys and various leisure products for its customer base.

Analysis and potential impact

The exposure of this data carries significant risks for the affected organization and its stakeholders. The inclusion of personal employee information creates a heightened risk for identity theft and the execution of targeted phishing attacks against the staff. Because the organization is based in Switzerland, this incident may lead to legal consequences under the General Data Protection Regulation (GDPR) and local data protection regulations.

The tactics employed by Black Basta are consistent with double-extortion methods. In a double-extortion scenario, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. If the victim refuses to pay the ransom, the group threatens to leak the stolen data publicly, causing reputational and financial damage. Black Basta has been noted for having reported connections to the Conti group, which is also associated with such tactics.

For organizations in the retail and technology sectors, the exposure of trade secrets and financial data can lead to long-term reputational damage in addition to immediate operational disruptions. To defend against such threats, organizations typically focus on strengthening network security, implementing robust access controls, and maintaining comprehensive data backup strategies. Regular monitoring of network traffic and employee training on phishing awareness are also standard defensive measures used to mitigate the risk of such breaches.