Black Basta ransomware group lists olsonsteel.com on its leak site

• Ransomware group: Black Basta
• Country: United States
• Sector: Professional Services
• Announcement date: May 4, 2024

Black Basta claims data breach at Olson & Co. Steel

The Black Basta ransomware group has listed approximately 900 GB of data on its leak site, claiming that the information belongs to Olson & Co. Steel. This announcement, made on May 4, 2024, indicates a potential data breach that could affect the organization's operational information and sensitive internal records.

The group claims to have exfiltrated the data following a cyberattack that allegedly occurred on May 7, 2024. This type of incident is characteristic of modern ransomware tactics, often involving double extortion. In such scenarios, threat actors do not merely encrypt a victim's systems to demand a ransom for decryption; they also steal sensitive data to threaten public disclosure. This secondary pressure tactic aims to force the organization into payment by leveraging the threat of exposing confidential information to the public or competitors.

Details of the claimed data exfiltration

According to the announcement made by the threat actors, the stolen data set is substantial in size. The group claims to have accessed a vast amount of information, which allegedly includes a variety of sensitive files necessary for the company's daily operations and administrative functions. The leaked information is said to encompass several critical categories of data that could impact both the company and its stakeholders.

The specific types of data mentioned in the listing include:

• Human resources data
• Accounting records
• Employee personal data
• Project drawings and CAD files

The inclusion of such diverse data types—ranging from administrative personnel files to highly technical engineering documents—suggests a comprehensive breach of the organization's digital environment. While the specific file count was not provided in the announcement, the volume of data is estimated by the group to be around 900 GB.

About Olson & Co. Steel

Olson & Co. Steel is a professional services organization operating as a steel contractor. The company specializes in providing steel fabrication, erection, and specialty construction services. The firm has a long-standing history in the construction industry, having served the sector since the 1960s. The current corporate entity was formed in 2002 through the consolidation of two established firms: Bostrom Bergen Metal Products and Meddco Metals.

Potential impacts and industry implications

This breach may pose significant secondary risks, such as identity theft and targeted phishing attacks, for Olson & Co. Steel employees and customers. Because the organization is located in the United States, the incident could trigger state-level data protection regulations and potential regulatory scrutiny depending on the nature of the exposed information. Furthermore, the exposure of technical drawings and project documentation may negatively impact the organization's competitive position in the market.

The assessment of this attack suggests that the Black Basta group, which has been linked to Conti, may be operating with professional motivation. This implies that the attack could be specifically designed to compromise the organization's intellectual property. For companies in the construction and fabrication sectors, the loss of CAD drawings and project-related files represents a direct threat to proprietary methods and competitive advantages.

In general, organizations facing such threats can benefit from implementing robust defensive measures. These typically include maintaining offline backups, enforcing multi-factor authentication across all systems, and conducting regular security awareness training for employees to prevent initial access via phishing. For sectors involving specialized engineering, protecting intellectual property through strict access controls and network segmentation is also a critical defensive component to mitigate the impact of a potential breach.