Black Basta ransomware group lists DOMAIN-BACCARAT_2 on its leak site

• Ransomware group: Black Basta
• Country: France
• Sector: Manufacturing
• Announcement date: October 16, 2023

The luxury crystal manufacturer Baccarat has been listed on the leak site of the Black Basta ransomware group. The group has published data they claim belongs to the organization, alleging that they successfully gained access to the company's systems and exfiltrated sensitive information.

The alleged attack and claims by Black Basta

The announcement regarding the breach follows an incident that was reported to have occurred on October 16, 2023. According to the claims made by the Black Basta group, they have compromised the organization's internal systems. This type of activity is characteristic of modern ransomware operations, where attackers move beyond simple encryption to focus on data theft.

Ransomware leak sites serve as a platform for cybercriminal groups to pressure victims. In these scenarios, attackers often employ double-extortion tactics. This method involves two distinct layers of pressure: first, encrypting the victim's systems to disrupt operations, and second, threatening to release stolen sensitive data on a public leak site if a ransom is not paid. By threatening to expose private information, the attackers aim to maximize their leverage over the target organization.

Data involved in the alleged breach

Based on the information provided by the group, the leaked data is intended to cause significant harm to the individuals involved. The group has provided evidence in the form of screenshots to support their claims of a successful exfiltration.

The following types of data are identified as being part of the alleged breach:

• Passport information
• Employee personal data

The presence of such sensitive identification documents increases the severity of the incident, as these items are highly valuable for malicious actors.

About Baccarat

Baccarat is a world-renowned French brand founded in 1764. The company specializes in the design, manufacture, and retail of luxury crystal products. Their diverse portfolio includes sectors such as lighting, tableware, decorative objects, and jewelry.

Risk assessment and organizational implications

The alleged leaked data is considered high-risk because it contains specific employee identification details. The exposure of such information can lead to serious consequences for the affected individuals, including the risk of identity theft and the potential for highly targeted phishing attacks. When personal identifiers like passport information are compromised, the difficulty of protecting the victims from subsequent social engineering attempts increases significantly.

Furthermore, because the organization is based in France, the incident may lead to administrative sanctions under the General Data Protection Regulation (GDPR) due to potential data protection breaches. Regulatory frameworks like GDPR are designed to ensure that organizations maintain strict controls over personal data, and failures in these controls can result in significant legal and financial repercussions.

The Black Basta group, which has been assessed to have links to Conti, is known for actively employing these double-extortion tactics. The publication of stolen data can create lasting negative impacts on an organization's operational credibility and reputation. To defend against such threats, organizations in the manufacturing and luxury goods sectors often focus on strengthening their perimeter defenses, implementing strict access controls, and enhancing monitoring capabilities to detect unauthorized data movement. Regular security audits and robust incident response plans are also essential components of a comprehensive cybersecurity strategy to mitigate the impact of potential exfiltration events.