BlackBasta claims data leak involving rekord.de

• Ransomware group: BlackBasta
• Country: Germany
• Sector: Manufacturing
• Announcement date: November 14, 2023

BlackBasta claims a massive data breach at rekord.de

The ransomware group known as BlackBasta has issued an announcement on its leak site claiming to have compromised the German manufacturing company rekord.de. According to the group's claims, the breach involved a significant volume of data, and they have listed the victim's information on their dedicated leak platform.

Ransomware actors often utilize leak sites as a tool for double extortion. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data beforehand. The threat of releasing this stolen information publicly serves as additional leverage to pressure the victim into paying a ransom. By publishing a claim of a breach, these groups attempt to damage the victim's reputation and create legal or regulatory pressure.

Details of the alleged exfiltration

The BlackBasta group claims that the data exfiltration occurred on November 14, 2023. The group asserts that they have successfully stolen 917 GB of data from the organization. While the group has made these claims publicly, the exact contents and the full scope of the breach remain subject to the group's assertions.

The data identified by the threat actor is said to include a variety of sensitive information types. The claimed stolen data includes:

• Corporate data
• Personal data
• Projects
• CAD files
• User data

The presence of such diverse data types suggests a broad compromise of the target's digital environment. When technical files like CAD files are involved, it indicates that the breach may extend beyond simple administrative files and into the core intellectual property of the company.

About rekord.de

Rekord is a German window manufacturer with over 100 years of experience. The company specializes in custom-made windows, muntin windows, and windows for historical preservation. Holding the RAL quality mark, the organization focuses on high-quality craftsmanship and technical precision in its production processes.

Potential impact and industry implications

The alleged leak of this data could potentially impact the company's operational processes and its intellectual property. Specifically, the inclusion of CAD files may pose significant risks to the company's technical designs, which are vital to its manufacturing specialization. Furthermore, given the nature of the data involved, such an incident may trigger mandatory data breach procedures under the General Data Protection Regulation (GDPR).

The group's historical activities suggest that executing attacks of this nature may require a complex infrastructure. For organizations in the manufacturing sector, such incidents can lead to reputational damage or secondary risks, such as targeted phishing campaigns directed at employees or partners using the stolen user data.

To mitigate these risks, organizations typically focus on robust defensive measures. Implementing strict access controls and multi-factor authentication can help prevent unauthorized access. Regularly backing up critical data and conducting regular security audits are also essential components of a modern cybersecurity posture. In the event of a suspected breach, following established incident response plans and complying with regulatory notification requirements are vital steps for any enterprise.