Black Basta ransomware group lists NCC_2 on its leak site

• Ransomware group: Black Basta
• Country: United States
• Sector: Technology
• Announcement date: October 16, 2023

The Black Basta ransomware group has listed the United States-based technology and advertising company Ampersand on its leak site. According to the announcement made on October 16, 2023, the group claims to have gained access to sensitive information belonging to the organization following a cyberattack that allegedly occurred on September 28, 2023.

The alleged cyberattack and claims

The Black Basta group has posted a claim on its dedicated leak site regarding the compromise of Ampersand. The group asserts that they successfully breached the organization's systems, leading to the acquisition of various documents. While the specific details regarding the total volume of data or the exact number of files stolen have not been provided by the group, the announcement includes samples intended to demonstrate the nature of the breach.

The group's activities are consistent with a Ransomware-as-a-Service (RaaS) model, where specialized developers provide the ransomware code to affiliates who carry out the actual attacks. Black Basta, which has been active since early 2022, is assessed to have links to the Conti group. This group is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage for extortion. By threatening to publicly release stolen data, the attackers aim to exert maximum pressure on the victim to meet their demands.

Data involved in the leak

Based on the screenshots and information provided by the group, the leaked data appears to consist of various corporate documents. These documents are reportedly part of the organization's operational processes and include sensitive business information. The content visible in the shared samples includes tables containing contact information for business partners and signed legal agreements.

The specific types of data identified in the listing include:

• Non-disclosure agreements
• Business partner contact information

The presence of such documents suggests that the breach could expose internal business relationships and legal frameworks governing the company's interactions with third parties.

About Ampersand

Ampersand is a company operating in the field of data-driven TV advertising sales and technology. The organization reaches multiscreen households and provides viewership insights and planning services to advertisers. As a player in the technology and advertising sector, the company relies on data to facilitate its specialized services for its clients.

Implications and organizational risks

The potential exposure of the leaked data carries several significant risks for Ampersand and its ecosystem. The release of non-disclosure agreements and business partner contact details may lead to the exposure of trade secrets. Furthermore, this information could be used to launch secondary attacks against the company's business partners, potentially compromising the broader supply chain.

Because the organization is based in the United States, a confirmed data breach of this nature may trigger various legal processes under relevant state laws and federal regulations. Additionally, the leaked documents could be utilized by threat actors in highly targeted phishing campaigns, posing a continuous risk to the company's security posture and its relationships with external entities.

For organizations operating in the technology and advertising sectors, such incidents highlight the critical importance of robust data protection strategies. Common defensive measures often include implementing strict access controls, maintaining comprehensive logging to detect unauthorized access, and conducting regular security audits. Furthermore, because attackers often use stolen information for social engineering, organizations must prioritize employee training to recognize phishing attempts and implement strong multi-factor authentication across all corporate systems to mitigate the risk of credential theft and subsequent lateral movement within the network.