Black Basta ransomware group lists piemmeonline.it on its leak site

• Ransomware group: Black Basta
• Country: Italy
• Sector: Technology
• Announcement date: November 1, 2023

Black Basta claims data breach at Piemme S.p.A.

The Black Basta ransomware group has published a data leak announcement targeting the Italy-based media platform Piemme S.p.A. According to the group's claims, the organization has suffered a data breach, and the threat actors have listed the entity operating under the domain piemmeonline.it on their dedicated leak site.

Details of the alleged attack

The announcement regarding the breach was discovered on November 1, 2023. While the leak site listing was identified in November, the group states that the actual attack occurred on October 3, 2023. To support their claims of a successful intrusion, the Black Basta group has shared various documents as evidence, which they assert belong to the targeted organization.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms by threatening to release sensitive information. In many modern ransomware campaigns, groups employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. This allows the group to threaten the public release of stolen information if the ransom is not met, significantly increasing the pressure on the victim organization.

Data samples and affected information

The group has provided screenshots as evidence of the breach. These screenshots reportedly contain sensitive documentation belonging to the organization. Based on the samples provided by the threat actors, the following types of information are reportedly involved:

• Passport data
• Corporate contracts

The presence of such documents suggests that the data may include highly sensitive personal information belonging to employees or business partners. The exposure of identity documents like passports and legal agreements can pose significant risks to the individuals involved, as this information is frequently targeted for identity theft or highly customized, targeted phishing campaigns.

Organizational profile of Piemme S.p.A.

Piemme S.p.A. is a media platform operating under the Caltagirone Editore Group. The company provides advertising space sales and media services for newspapers, magazines, radio, television, and digital channels.

Assessment and industry implications

Black Basta is assessed to be a Ransomware-as-a-Service (RaaS) operation with known links to the Conti group. Because the organization is based in Italy, this incident may lead to legal consequences under the General Data Protection Regulation (GDPR) due to the potential exposure of personal data.

For organizations operating within the media and technology sectors, such incidents highlight the critical importance of robust data protection frameworks. When sensitive documents like corporate contracts and personal identification are at risk, the potential for secondary crimes such as identity theft increases. Organizations in this sector can take defensive steps by implementing strict access controls, monitoring for unauthorized data exfiltration, and ensuring comprehensive encryption for data at rest and in transit. Furthermore, maintaining a rigorous incident response plan and ensuring compliance with regional data protection laws are essential components of a modern cybersecurity posture to mitigate the impact of potential double-extortion tactics.