Black Basta ransomware group lists amerlux.com on its leak site

• Ransomware group: Black Basta
• Country: United States
• Sector: Manufacturing
• Announcement date: March 27, 2024

Black Basta claims data theft from Amerlux

The US-based lighting solutions manufacturer Amerlux has been listed on the leak site of the Black Basta ransomware group. According to the announcement posted by the threat actors on March 27, 2024, the group claims to have successfully exfiltrated a significant volume of data belonging to the organization. The group asserts that the breach occurred around March 13, 2024.

The Black Basta group claims to have stolen approximately 790 GB of data. In their announcement, the group asserts that the stolen information includes a variety of sensitive materials. To pressure the victim, the group has initiated a countdown process for the public release of the alleged data on their leak site. This tactic is a hallmark of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt a company's systems but also threaten to publish sensitive information to force a ransom payment.

Details of the alleged data exfiltration

The information provided by the ransomware group suggests that the breach involves a wide range of internal documentation. Based on the claims made in the leak site announcement, the stolen data is said to include the following categories:

• Corporate data
• Engineering drawings
• Personal user folders

The group has provided screenshots as evidence, which allegedly display sample folder names belonging to the company's directory to support their claims of unauthorized access and data theft.

About Amerlux

Amerlux is a company that has been designing and manufacturing interior and exterior lighting solutions since 1984. As a subsidiary of Delta Electronics, the firm develops aesthetic and high-performance lighting products for architects and designers.

Potential impact and industry risks

The claims made by the Black Basta group may pose significant risks to the organization's operational continuity and intellectual property rights. The exposure of engineering drawings is particularly concerning, as it could weaken the company's competitive advantage and threaten its trade secrets. Furthermore, the disclosure of personal data may place the organization in a difficult position regarding US state-level data privacy regulations and potential legal obligations.

Beyond the immediate impact on Amerlux, there is the possibility that the leaked data could be used in secondary attacks or targeted phishing campaigns against the organization or its partners. The group responsible, Black Basta, has limited public information available regarding its operations, though it is assessed to have connections to the Conti group.

For organizations operating in the manufacturing sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting intellectual property, such as engineering designs, is vital for maintaining market position. Companies often implement defensive measures such as network segmentation, strict access controls, and comprehensive data encryption to mitigate the risk of unauthorized exfiltration. Additionally, maintaining rigorous incident response plans and monitoring for unusual data movement can help organizations detect and respond to such threats more effectively.