BlackBasta ransomware group lists alexander-dennis.com on its leak site

• Ransomware group: BlackBasta
• Country: United States
• Sector: Manufacturing
• Announcement date: December 13, 2023

BlackBasta claims to have stolen data from Alexander Dennis

The BlackBasta ransomware group has listed a significant amount of data on its dedicated leak site, claiming the information belongs to the bus and coach manufacturer Alexander Dennis. According to the announcement made on December 13, 2023, the threat actor claims to have exfiltrated 507 GB of data from the organization.

The threat actor asserts that the unauthorized access to the company's systems was achieved following a cyberattack that allegedly took place on December 7, 2023. This type of activity is characteristic of modern ransomware operations, where attackers often employ a double extortion tactic. In such scenarios, the threat actors not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information to use as leverage, threatening to publish the data on a public leak site if a ransom is not paid.

Details of the alleged data exfiltration

The announcement posted by the BlackBasta group suggests that the compromised files are related to the organization's internal operational and administrative processes. The group claims that the stolen information is highly sensitive and encompasses various departments within the company. While the specific ransom demand has not been disclosed in the announcement, the volume of data suggests a significant breach of corporate information.

Based on the information provided in the leak site post, the stolen data is said to include the following categories of information:

• Human resources (HR) records
• Financial documents
• Legal files
• Engineering documentation
• Group data

The exposure of such diverse datasets—ranging from sensitive personnel information to proprietary engineering files—indicates a deep penetration into the organization's digital environment.

About Alexander Dennis

Alexander Dennis is a prominent bus and coach manufacturer headquartered in Scotland. As the largest bus manufacturer in the United Kingdom, the company maintains a significant presence in the transportation sector. Beyond its primary operations in the UK, Alexander Dennis operates various manufacturing plants and maintains strategic partnerships in numerous countries around the world, making it a major player in the global manufacturing landscape.

Potential implications and risks

The alleged exposure of this data carries several serious implications for the organization and its stakeholders. For the employees and partners of Alexander Dennis, the leak of human resources and personal data may create secondary risks, such as the potential for identity theft or the execution of highly targeted phishing attacks. Furthermore, the theft of engineering and financial documentation could have negative consequences for the company's trade secrets and its overall competitive advantage in the manufacturing industry.

Because the organization is based in the United Kingdom, this incident may trigger legal obligations and potential sanctions under the UK GDPR, depending on the specific nature and sensitivity of the exposed data. The requirement to notify regulatory bodies and affected individuals is a critical component of data protection compliance following such breaches.

The BlackBasta group is assessed to have professional motivations, with some assessments suggesting ties to the Conti group. This professionalized approach to cybercrime highlights the evolving threat landscape facing large-scale manufacturing entities. To defend against such sophisticated threats, organizations in this sector typically focus on robust security measures, including multi-factor authentication, regular network segmentation, comprehensive employee training to prevent phishing, and rigorous backup management to ensure operational resilience.