Black Basta lists TWINTOWER on leak site

• Ransomware group: Black Basta
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: August 17, 2023

Black Basta claims access to TWINTOWER data

The Black Basta ransomware group has officially listed the retail company TWINTOWER on its dedicated leak site. According to the announcement made on August 17, 2023, the threat actor group claims to have successfully gained unauthorized access to the organization's internal data. This development follows a pattern of double extortion tactics often employed by modern ransomware operations, where attackers not only encrypt systems but also threaten to publish sensitive information to pressure victims into paying a ransom.

The claim was posted on the group's platform on the same day it was reportedly executed. While the listing marks a significant escalation in the threat profile for the targeted organization, technical observation of the leak site itself has encountered difficulties. Current evidence, including screenshots, indicates that the specific leak page is currently inaccessible to observers due to a technical error, specifically a 403 Forbidden error. This lack of visibility makes it difficult to verify the immediate status of the leaked content through the group's own infrastructure.

Details regarding the alleged data breach

At this stage of the incident, there is no information available regarding the specific nature or the content of the allegedly leaked data. The group has not provided details concerning the volume of files or the total size of the data set involved in the breach. Furthermore, no specific ransom demand has been publicly disclosed in the initial announcement.

Because the leak page remains unreachable due to technical errors, the specific types of information that the group claims to possess remain unknown. The listing names no data types at this time.

About TWINTOWER

Twin Towers Trading is a specialized firm that has been established since 1993. The company is a player in the retail and e-commerce sector, focusing on the marketing and promotion of various consumer products. They are particularly known for their expertise in live product demonstrations and dynamic presentations, a concept referred to as "retailtainment," which is utilized in both television and retail environments. With multiple offices operating worldwide, the organization maintains a significant multinational presence.

Risk assessment and industry implications

The actions taken by the Black Basta group pose significant risks to the company's operational processes and the security of its customer data. Given that TWINTOWER maintains a multinational structure with offices worldwide, a confirmed data breach could trigger complex legal obligations. These include compliance requirements under the General Data Protection Regulation (GDPR) as well as various local data protection regulations across the different jurisdictions in which they operate.

Beyond the immediate operational disruption, secondary risks are a major concern for organizations in the retail and e-commerce sector. If sensitive data is indeed exfiltrated, it may be used by malicious actors for identity theft or as a foundation for highly targeted phishing attacks against customers or employees. Such attacks leverage the stolen information to appear legitimate, increasing the likelihood of success in social engineering schemes.

Black Basta is a Ransomware-as-a-Service (RaaS) operation that has been active since early 2022. Intelligence assessments suggest the group may have links to the Conti group. Because of the sophisticated nature of RaaS operations, organizations targeted by such groups may need to remain highly cautious regarding potential ransom demands. In general, organizations facing such threats are encouraged to bolster their defensive posture through robust backup strategies, continuous monitoring, and strict adherence to data protection protocols to mitigate the impact of potential extortion attempts.