BlackSuit ransomware group lists frankmiller.com on leak site

• Ransomware group: BlackSuit
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: May 9, 2024

BlackSuit claims cyberattack against frankmiller.com

The BlackSuit ransomware group has officially listed frankmiller.com on its dedicated leak site, claiming that the organization has been the target of a cyberattack. This announcement, made public through the group's official platform, suggests that the threat actors claim to have successfully breached the organization's digital infrastructure.

According to the information provided by the threat actors, the incident involves an unauthorized access to the organization's systems. The group alleges that this access was used to perform data exfiltration, a process where sensitive information is moved from the victim's network to a location controlled by the attackers. Such claims are a common tactic used by ransomware groups to pressure victims into meeting their demands.

Details of the alleged breach

The announcement regarding the incident was made on May 9, 2024, following an alleged attack date of April 19, 2024. While the group has publicized the organization's name through screenshots on their platform, the specific details regarding the nature or the scope of the allegedly leaked data remain unknown. There is no information provided regarding the specific files or the volume of information involved in this incident.

The listing names no specific data types or categories of compromised information.

About frankmiller.com

Frank Miller is a Switzerland-based manufacturing company. The organization provides high-quality metalworking and production solutions, specializing in industrial and technical applications. As a player in the manufacturing sector, the company provides essential production services for various technical fields.

Analysis and industry implications

The BlackSuit group is assessed to be a continuation of the Royal ransomware operations. This connection suggests a level of continuity in these types of cybercriminal activities. In such scenarios, there is a risk that the organization's data may have been encrypted, or that the exfiltrated data might be used as part of a double-extortion scheme. Double extortion is a common ransomware tactic where attackers not only encrypt the victim's data to disrupt operations but also threaten to leak sensitive information publicly to increase the pressure to pay the ransom.

Because the organization is based in Switzerland, a confirmed data breach could trigger legal processes under the General Data Protection Regulation (GDPR) and local data protection regulations. Furthermore, as the organization operates within the manufacturing sector, this incident highlights potential risks to operational continuity and the possibility of increased supply chain risks. Disruptions in manufacturing can have a ripple effect across various industries that rely on their production solutions.

The fact that the group continues its activities despite law enforcement interventions in 2025 may suggest the persistence and severity of such attacks. For organizations in the manufacturing sector, maintaining robust cybersecurity postures is critical to mitigating these risks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.