Black Basta ransomware group lists kohlwholesale.com on its leak site

• Ransomware group: Black Basta
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: December 16, 2023

The Black Basta ransomware group has listed data allegedly belonging to Kohl Wholesale on its leak site. The threat actor group claims to have obtained a significant volume of information, specifically a total of 525 GB of data, during a cyberattack targeting the organization.

The alleged data breach event

According to the claims made by the Black Basta group, the organization was targeted in an attack that allegedly occurred on December 4, 2023. The group subsequently announced the breach on its leak platform on December 16, 2023. This type of announcement is a common tactic used in double extortion ransomware campaigns, where attackers not only encrypt an organization's systems but also threaten to release sensitive information on public leak sites to pressure the victim into paying a ransom.

The group's announcement includes a list of various file categories that are said to contain both operational and personal information. By publishing these details, ransomware groups aim to maximize the reputational damage and operational disruption caused to the victim organization.

Data types involved in the claim

The announcement specifies that the stolen data contains a variety of sensitive documents. The information allegedly exfiltrated from the organization's systems includes several categories of files that could impact both business operations and individual privacy. The listed data types include:

• Accounting records
• Accident information
• Customer service data
• Human resources data
• Driver's licenses
• Medical cards

The presence of such diverse data types suggests that the attackers may have gained access to multiple internal departments, ranging from administrative and financial sectors to human resources and logistics.

About Kohl Wholesale

Kohl Wholesale is a broadline food service distributor operating in the United States, specifically within the states of Illinois, Iowa, and Missouri. As a family-owned business, the company provides a wide range of national and regional brand products to its customers, offering over 14,000 products to meet various food service needs.

Risk assessment and industry implications

Black Basta is a ransomware group that has been active since early 2022 and is assessed to have links to the Conti group. The presence of personally identifiable information in the alleged leak may pose secondary risks such as identity theft or targeted phishing attacks for employees and customers. Because the stolen data includes sensitive documents like driver's licenses and medical cards, the potential for misuse by malicious actors is high.

As the organization is based in the United States, this incident may trigger data privacy compliance processes under relevant state laws and federal regulations. Furthermore, the breach may have broader implications for the supply chain; supply chain partners of the organization may also be exposed to indirect risks resulting from this breach. Given the group's known methods, the publication of this data could potentially impact the organization's commercial reputation.

In the food production and distribution sector, maintaining the integrity of supply chain data is critical. Organizations in this sector often deal with a vast array of logistical, personal, and financial data, making them attractive targets for sophisticated ransomware groups. To mitigate such risks, organizations typically implement defensive measures such as multi-factor authentication, regular data backups, and network segmentation to prevent lateral movement by attackers.