BlackBasta ransomware group lists brachot.com on its leak site

• Ransomware group: BlackBasta
• Country: Belgium
• Sector: Manufacturing
• Announcement date: January 11, 2025

BlackBasta claims data exfiltration from Brachot

The BlackBasta ransomware group has published an announcement on its leak site claiming responsibility for a cyberattack against Brachot, an international manufacturing company. According to the threat actors, the breach occurred around December 11, 2024, and the announcement was made public on January 11, 2025. The group alleges that they have successfully exfiltrated a significant volume of sensitive information belonging to the organization.

The threat actors claim that the amount of data compromised exceeds 600 GB. This stolen information is said to be related to the company's various production sites and its general business operations. While the group has made these claims on their leak site, attempts to access the specific leak site resulted in a 403 Forbidden error, making direct verification of the posted content difficult.

Details of the alleged data breach

The announcement by BlackBasta suggests that the breach involves a wide array of corporate and sensitive information. The group claims to have accessed various departmental records and documents that are critical to the company's daily operations. This includes a variety of file types and data categories that could impact multiple facets of the business.

According to the claims made by the ransomware group, the compromised data includes:

• Financial records
• Personal employee data
• Accounting documents
• CAD drawings

The inclusion of such diverse data types suggests that the attackers targeted multiple layers of the corporate network, ranging from administrative and financial departments to technical and engineering sectors.

About Brachot

Brachot is an international company that specializes in the production and wholesale of natural stone, ceramics, and composite materials. The firm offers a wide portfolio of materials designed for both interior and exterior applications. To support its global operations, Brachot operates multiple production sites and quarries located throughout the world.

Impact and potential risks

This leak claim suggests that the employees and financial processes of Brachot may be at risk. The alleged compromise of personal information could lead to identity theft or targeted phishing attacks against employees. Furthermore, the potential exposure of the company's technical drawings and production data may pose risks to trade secrets.

Given that BlackBasta has a history of such activities, it is considered that the exfiltrated data could be utilized for secondary extortion methods. In modern ransomware attacks, groups often employ a "double extortion" tactic, where they not only encrypt the victim's systems but also threaten to leak sensitive data on public forums to pressure the organization into paying a ransom. This method increases the pressure on companies, as the loss of intellectual property and personal data can cause long-term reputational and operational damage.

As a company based in Belgium, it is expected that this incident may trigger data breach notification obligations under the General Data Protection Regulation (GDPR). Organizations operating in the manufacturing sector often face similar risks, where the theft of technical specifications and CAD drawings can undermine competitive advantages. To mitigate such risks, companies typically focus on implementing robust access controls, monitoring for unauthorized data exfiltration, and maintaining rigorous security protocols for their production and engineering environments.