Black Basta ransomware group lists zircodata.com on its leak site

• Ransomware group: Black Basta
• Country: Australia
• Sector: Professional Services
• Announcement date: February 22, 2024

Black Basta claims data breach at Zircodata

The Black Basta ransomware group has listed the Australian professional services company Zircodata on its leak site. According to the announcement made on February 22, 2024, the threat actors claim to have exfiltrated approximately 395 GB of data belonging to the organization. This listing follows an alleged attack that took place on February 7, 2024.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In this model, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information, threatening to publish it publicly if their demands are not met. This method increases the pressure on the victim by threatening their reputation and legal standing.

Details of the alleged data theft

The threat actors behind the Black Basta group have indicated that the stolen information is quite extensive. The group claims that the leaked data includes a variety of sensitive files that could impact the organization's internal operations and its relationship with clients. The contents of the alleged leak reportedly consist of the following types of information:

• Financial records
• IT documents
• Personal user folders
• Non-disclosure agreements
• Public records
• RM/RMCorp files

The presence of such diverse data types, ranging from technical IT documentation to private user folders and legal agreements, suggests a broad access level during the intrusion. While the group has not specified a ransom demand, the volume of data and the nature of the files involved suggest a significant breach of confidentiality.

About Zircodata

Zircodata is an Australian-based company that has been providing records and information management, secure document storage, digital conversion, and destruction services since 1995. Through its centers across Australia, the company provides information management and risk mitigation solutions to over 9,000 customers.

Implications and security considerations

The alleged leak indicates a risk of exposure for a significant volume of sensitive data, considering Zircodata's role in records and information management. Under Australian data protection regulations and privacy principles, this incident may lead to legal and regulatory consequences for the organization. The exposure of customer and employee data could increase the risk of secondary threats, such as identity theft and targeted phishing attacks.

The Black Basta group's historical ties to Conti and its RaaS (Ransomware-as-a-Service) model suggest that the attack may have been carried out with professional motivation. In a RaaS model, developers lease their ransomware code to affiliates who carry out the actual attacks, allowing for specialized and highly organized operations. Given the nature of the services provided by the institution, this breach could also have a negative impact on supply chain security.

For organizations operating in the professional services and information management sectors, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication (MFA) across all remote access points, maintaining offline or immutable backups to ensure data recovery, and conducting regular vulnerability assessments. Furthermore, because these organizations often handle third-party data, they are integral parts of their clients' supply chains, making them high-value targets for attackers looking to compromise multiple entities through a single point of entry.