Black Basta lists rembe.de on leak site claiming data breach

• Ransomware group: Black Basta
• Country: Germany
• Sector: Manufacturing
• Announcement date: November 19, 2024

The Black Basta ransomware group has listed the German manufacturing company rembe.de on its dedicated leak site. According to the announcement made on November 19, 2024, the threat actor group claims to have compromised a significant amount of data belonging to the organization. This development follows an alleged attack date of November 4, 2024.

The claims made by Black Basta

The Black Basta group has posted a claim involving approximately 1 TB of data that they assert belongs to rembe.de. Through this public listing, the group is attempting to exert pressure on the organization. Such tactics are common in modern ransomware operations, often referred to as double extortion, where attackers not only encrypt an organization's systems but also threaten to publish sensitive information to coerce the victim into paying a ransom.

By publishing this information on their leak site, the group aims to damage the target's reputation and create operational chaos. This method of extortion relies on the sensitive nature of the stolen information to maximize the pressure placed on the victim's leadership and stakeholders.

Data allegedly compromised in the attack

The announcement made by the group specifies that a wide variety of sensitive information has been targeted. The group claims that the stolen data includes critical corporate and personal information. According to the listing, the following types of data are involved:

• Financial data
• Personal employee data
• R&D documents
• Engineering data

The presence of such diverse data types suggests a comprehensive breach of the organization's digital environment, ranging from administrative financial records to highly technical intellectual property.

About rembe.de

REMBE GmbH Safety + Control is a German company specializing in explosion safety and pressure relief systems. Founded in 1973, the company provides safety solutions for various industries, including food, chemical, pharmaceutical, and wood sectors.

Impact and security implications

This incident may negatively impact the organization's operational continuity and commercial reputation. The presence of employee data in the leaked information could increase the risk of identity theft or targeted phishing attacks against the affected personnel. Furthermore, as the organization is based in Germany, legal proceedings and administrative sanctions regarding data protection violations under GDPR may be initiated.

Black Basta is a Ransomware-as-a-Service (RaaS) group that emerged in early 2022 and is assessed to have links to the Conti group; it is known that the group's internal communications were leaked in early 2025. The nature of the leaked data suggests that the organization may need to notify affected parties and implement necessary security measures.

In general, when organizations face such breaches, they must prioritize incident response to contain the threat and assess the full scope of the exposure. Protecting intellectual property and personal data is vital for maintaining trust with clients and employees. Organizations in the manufacturing sector often face high-stakes risks when R&D and engineering data are compromised, as this information is central to their competitive advantage and market position.