Black Basta ransomware group lists maytec.de on its leak site

• Ransomware group: Black Basta
• Country: Germany
• Sector: Manufacturing
• Announcement date: November 14, 2023

Black Basta claims to have stolen data from Maytec

The Black Basta ransomware group has listed the German organization Maytec on its dedicated leak site. Through this announcement, the threat actor group claims to be in possession of corporate data belonging to the company. This listing, which occurred during 2023, follows a pattern of double extortion often utilized by modern ransomware operations.

In many ransomware attacks, threat actors employ a double extortion strategy. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive information. The attackers then threaten to publish this stolen data on a public leak site if the ransom demands are not met. This approach increases the pressure on the victim by threatening their reputation and legal standing.

The announcement made by Black Basta suggests that the group has successfully accessed internal files. While the specific details regarding the exact date of the initial intrusion or the total volume of data stolen were not provided in the announcement, the group has publicly identified Maytec as a target.

Data types identified in the leak

The information provided by the threat group includes a screenshot that purportedly shows the contents of the stolen data. Based on the visual evidence shared in the announcement, the breach appears to involve a variety of sensitive corporate and administrative files. The exposure of such diverse data types can significantly impact an organization's internal operations and external relationships.

The files displayed in the provided screenshot include:

• CAD files
• Financial records
• Accounting documents
• Confidential personnel files

The presence of CAD files is particularly significant for companies in the engineering and manufacturing sectors, as these represent intellectual property and technical designs. Furthermore, the inclusion of personnel and financial documents indicates that the breach may have extended into the administrative core of the organization.

About Maytec

Maytec is a Germany-based international manufacturing company specializing in modular profile systems and engineering solutions. The company operates a global network of representatives and manufactures aluminum profile systems for industrial applications.

Impact assessment and industry implications

The alleged leak of data poses several significant risks to the organization. One of the primary concerns involves the threat to the company's operational continuity and the potential loss of trade secrets. When technical designs, such as CAD files, are exposed, it can undermine the competitive advantage of a manufacturing firm. Additionally, the exposure of personal data may lead to legal consequences under the European Union's General Data Protection Regulation (GDPR).

The disclosure of employee and client data can create opportunities for malicious actors to conduct identity theft or launch targeted phishing attacks. Such attacks often use the stolen information to gain further access to the network or to defraud the individuals involved. Furthermore, the organization's supply chain partners may also be indirectly affected by this incident, as data breaches in one part of a production network can ripple through the entire ecosystem.

The sophistication of such attacks is often linked to the history of the threat actor. Black Basta's known history, including its links to Conti, suggests that these attacks may be conducted using highly sophisticated methods. To defend against such threats, organizations in the manufacturing sector often implement defensive steps such as multi-factor authentication, regular offline backups, and strict network segmentation to prevent lateral movement by attackers.