Black Basta ransomware group lists agrovi.dk on its leak site

• Ransomware group: Black Basta
• Country: Denmark
• Sector: Agriculture and Food Production
• Announcement date: November 20, 2023

Black Basta claims data breach against Agrovi

The Danish-based agricultural and consulting firm Agrovi has been listed on the leak site of the Black Basta ransomware group. According to the announcement made on November 20, 2023, the group claims to have successfully targeted the organization. The group alleges that the attack took place on November 7, 2023, and involves a significant volume of exfiltrated information.

Ransomware attacks often follow a pattern of double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release this data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This tactic increases the pressure on organizations, as the impact extends beyond operational downtime to potential legal, regulatory, and reputational consequences.

Details of the alleged data leak

The Black Basta group claims to have stolen 812 GB of data belonging to Agrovi. In their announcement, the group alleges that the stolen information includes a variety of sensitive categories. To support their claims, the group shared a screenshot displaying the internal directory structure of the organization, providing a glimpse into the victim's file management system.

The group alleges that the following types of data were involved in the breach:

• Corporate data
• User data
• Personal files

While the group has provided details regarding the volume and general nature of the files, no information was provided regarding the specific ransom demand or the exact file count.

About Agrovi

Agrovi is a Danish company that provides a specialized range of services for the agricultural sector. The organization offers finance, auditing, trade, and consulting services. Furthermore, the company specializes in regenerative agriculture practices, accounting, and legal advisory services, making it a key player in the agricultural business infrastructure in Denmark.

Impact and security implications

The alleged leak poses several significant risks to Agrovi. The exposure of personal data could directly impact the privacy of the organization's employees and clients. Because the organization is based in Denmark, this incident may trigger mandatory data breach notification requirements under the General Data Protection Regulation (GDPR).

Beyond privacy concerns, the publication of corporate data could potentially impact the company's trade secrets and its financial operations. Additionally, the leaked data might be utilized by malicious actors for identity theft or targeted phishing attacks, where attackers use stolen information to craft highly convincing fraudulent communications to deceive individuals.

Black Basta is known as a Ransomware-as-a-Service (RaaS) operation that emerged in early 2022. The group is assessed to have links to the Conti group, and reports indicate that the group's internal communications were leaked in early 2025. To defend against such threats, organizations typically implement security measures such as multi-factor authentication, regular offline backups, and continuous monitoring of network traffic to detect unauthorized data exfiltration.