Black Basta ransomware group lists leonardssyrups.com on its leak site

• Ransomware group: Black Basta
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: February 13, 2024

Black Basta claims data theft from Leonard’s Syrups

The Black Basta ransomware group has listed the Michigan-based food supplier Leonard’s Syrups on its leak site. According to the announcement made on February 13, 2024, the threat actor claims to have obtained unauthorized access to the company's data. The group asserts that they have exfiltrated a significant volume of information, specifically claiming that 453 GB of data has been compromised.

This incident appears to be a targeted attack aimed at the food and beverage sector. The threat actor has indicated that the attack allegedly occurred on January 30, 2024. By listing the organization on their public leak site, the group is utilizing a common tactic designed to exert maximum pressure on the victimized organization. This method of public shaming is a hallmark of modern ransomware operations, where the threat of leaking sensitive information is used as leverage to demand concessions from the target.

Details of the alleged data breach

The announcement made by Black Basta suggests that the stolen information is highly sensitive, potentially encompassing various aspects of the company's internal operations. The group claims that the compromised data relates to the organization's operational and financial processes. The scale of the leak, totaling 453 GB, indicates a substantial breach of digital assets.

According to the claims made by the threat actor, the leaked content is expected to include several categories of sensitive information. The specific types of data mentioned in the listing include:

• Corporate documents
• Human resources data
• Financial data
• Personal documents

The presence of such diverse data types—ranging from corporate and financial records to personal and human resources files—suggests a broad compromise of the organization's digital environment. Such a breach can lead to significant challenges for an organization attempting to manage the fallout of the incident.

About Leonard’s Syrups

Leonard’s Syrups is a family-owned and operated food and beverage supplier. The company has been operating in Michigan since 1964, establishing a long-standing presence in the industry. They provide a variety of essential products to various clients, including beverage syrups, draft beer equipment, and beverage gases. Their client base is diverse, serving bars, restaurants, and breweries across their operational area.

Impact and risks of the alleged attack

The alleged breach by the Black Basta group carries significant risks for all parties involved. For the employees and business partners of Leonard’s Syrups, the exposure of personal and human resources data increases the risk of identity theft and fraud. Furthermore, the disclosure of financial information could have a negative impact on the company's supply chain and may potentially facilitate secondary attacks against the organization or its partners.

Because the company operates within the United States, this incident may trigger investigations under state-level data protection laws and regulatory bodies, depending on the specific nature of the exposed data. The potential for regulatory scrutiny adds another layer of complexity to the situation.

It is important to note that Black Basta is assessed to have links to the Conti group. This connection is significant because it highlights the group's use of double-extortion tactics. In a double-extortion scenario, attackers do not just encrypt the organization's data to disrupt operations; they also steal the data and threaten to leak it publicly. This dual approach is designed to maximize the impact, causing both operational disruptions and significant reputational damage. Organizations in the food and beverage sector, which often rely on complex supply chains and high levels of trust with partners, should remain vigilant against such tactics through robust data protection and incident response strategies.