Black Basta ransomware group lists bender.de on its leak site

• Ransomware group: Black Basta
• Country: Germany
• Sector: Manufacturing
• Announcement date: December 18, 2024

Black Basta claims data breach against Bender GmbH & Co. KG

The Black Basta ransomware group has listed the domain bender.de on its leak site, claiming a significant data breach involving the German electrical safety solutions provider, Bender GmbH & Co. KG. According to the threat actors, the breach involves a massive volume of exfiltrated information, totaling approximately 1.1 TB of data.

Details of the alleged attack

The threat actors assert that they successfully gained unauthorized access to the organization's network on October 31, 2024. Following this initial access, the group claims to have exfiltrated a large dataset containing both operational and personal information belonging to the company. This announcement was officially posted on the group's leak site on December 18, 2024.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion, where they not only encrypt an organization's systems but also steal sensitive data. If the ransom is not paid, the group threatens to publish the stolen information publicly to cause maximum reputational and operational damage.

Scope of the alleged data exfiltration

The group claims to have stolen a wide variety of sensitive documentation. The alleged leak includes a diverse range of files that could impact various departments within the organization. The specific types of data mentioned in the claim include:

• Company data
• Personal data
• Private accounting records
• R&D documents
• Technical drawings
• HR files

The total volume of the data involved in this alleged incident is stated to be approximately 1.1 TB. No specific file count or ransom demand has been provided by the group in their announcement.

About Bender GmbH & Co. KG

Bender GmbH & Co. KG is a Germany-based international company specializing in electrical safety solutions. It provides products and services for smarter and safer electrical infrastructure across various sectors, including healthcare, manufacturing, renewable energy, and data centers.

Potential impact and security implications

The alleged breach may pose a significant risk of exposure for the personal data of employees and business partners within Bender GmbH & Co. KG. Furthermore, the publication of intellectual property, such as R&D documents and technical drawings, could potentially impact the company's competitive advantage in the electrical safety market.

Because the organization is based in Germany, the incident may lead to legal proceedings and administrative sanctions related to data protection violations under the General Data Protection Regulation (GDPR). Additionally, since the Black Basta group is assessed to be linked to Conti, these breaches may lead to secondary risks such as targeted phishing attacks and identity theft against the affected parties.

In such scenarios, organizations in the manufacturing and infrastructure sectors often face complex challenges. To mitigate these risks, companies generally focus on robust defensive measures. These include implementing multi-factor authentication (MFA) across all remote access points, maintaining strict network segmentation to prevent lateral movement by attackers, and conducting regular, comprehensive backups that are stored offline or in immutable environments. Furthermore, continuous monitoring of network traffic and employee security awareness training are essential components of a modern cybersecurity posture to defend against the types of exfiltration and extortion tactics used by groups like Black Basta.