Black Basta ransomware group lists MORSEMOVING on its leak site

• Ransomware group: Black Basta
• Country: United States
• Sector: Transportation
• Announcement date: June 20, 2023

Black Basta claims attack on Morse Moving

The Black Basta ransomware group has listed the United States-based transportation company MORSEMOVING on its dedicated leak platform. This announcement, which appeared on June 20, 2023, implies that a cyberattack may have been conducted against the organization's network. While the listing serves as a public claim by the threat actor, the provided screenshot associated with the announcement indicates that access to the relevant leak site is currently restricted, showing a site access error.

Ransomware groups often utilize leak sites to exert pressure on their victims. These platforms serve as a public gallery where the group lists organizations they have targeted. By publishing the names of companies, these actors aim to damage the reputation of the victim and increase the likelihood of a ransom payment. In many cases, these groups employ a tactic known as double extortion. In a double extortion scheme, the attackers do not merely encrypt the victim's data to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. This allows the group to threaten the public release of stolen data if the ransom is not met, creating a secondary layer of leverage against the organization.

Details regarding the alleged data breach

At this time, there is no information provided regarding the nature or scope of the allegedly leaked data. The announcement does not specify the volume of files or the total size of the data involved. Furthermore, the listing does not mention a specific ransom demand. Because the screenshot provided by the group displays a site access error, it does not provide any further details regarding the contents of the leak.

• No data types were named in the listing.

When organizations face such claims, the lack of immediate information can create significant uncertainty. In a typical ransomware scenario, the data targeted often includes proprietary business information, financial records, or sensitive personal data of employees and clients. However, in this specific instance, the details remain undisclosed by the threat actor.

Organization profile: Morse Moving

Morse Moving is a family-owned and operated moving and relocation company that was established in 1954. The company provides a variety of services, including both local and international relocation services. Their client base consists of both residential and corporate clients, serving a diverse range of needs in the relocation sector.

Risk assessment and industry implications

Black Basta is a Ransomware-as-a-Service (RaaS) group that has been active since early 2022. It is assessed to have connections to the Conti group. The potential leak of organizational data may create secondary risks such as identity theft or targeted phishing attacks for employees and customers. For a company operating within the United States, potential data breaches may be subject to various state-level privacy regulations, which govern how organizations must handle and report the exposure of personal information.

The operational structure of such groups is often subject to change. For instance, it has been noted that internal communication leaks from early 2025 may have led to changes in the group's operational structure. This evolution in threat actor behavior highlights the necessity for continuous monitoring of the threat landscape.

For organizations operating in the transportation and relocation sector, maintaining robust cybersecurity postures is critical. This includes implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee training to recognize phishing attempts. Because these companies often handle sensitive client information related to residential and corporate moves, they are high-value targets for attackers seeking to exploit personal or logistical data. Protecting the integrity of the network and ensuring data confidentiality is essential to mitigating the risks of both operational disruption and the long-term consequences of data exfiltration.