Losberger De Boer listed on BlackBasta ransomware leak site

• Ransomware group: BlackBasta
• Country: Germany
• Sector: Manufacturing
• Announcement date: June 7, 2022

The BlackBasta ransomware group has announced the listing of Losberger De Boer on their dedicated leak site. This announcement, which surfaced on June 7, 2022, indicates that the threat actor group claims to have successfully compromised the organization's data. The notification was made public through the group's official leak portal, marking a significant development in the ongoing threat landscape facing the manufacturing sector.

The claimed attack event

According to the announcement published by the BlackBasta group, the organization was targeted in a cyberattack that resulted in a data breach. The group claims that the organization's data has been compromised as of June 7, 2022. It is important to note that this information is based on the claims made by the ransomware group via their leak portal, and the occurrence of the breach is presented as an assertion by the attackers.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. By listing a target on a public portal, these groups aim to increase the visibility of the attack, often as a tactic to coerce the victim into paying a ransom. This method of operation is a hallmark of modern ransomware campaigns, where the threat of public exposure is used as a primary lever for extortion.

Details regarding the leaked data

Regarding the specific contents of the alleged breach, the current information remains limited. There are no details regarding the nature of the data shared in the leak announcement, and no screenshot is available to verify the contents of the files. The listing does not specify the volume of data or the specific file types that may have been exfiltrated during the incident.

Affected data types

• No specific data types were named in the listing.

About Losberger De Boer

Losberger De Boer is an international construction company specializing in temporary and permanent space solutions, industrial buildings, and event structures. The company provides modular building systems and space solutions for various industries. As an international entity operating within the manufacturing and construction sectors, the organization manages complex logistical and structural requirements for a diverse client base.

Potential impact and industry implications

This incident may lead to disruptions in the organization's operational processes and potential data privacy breaches. Depending on the content of the allegedly leaked data, secondary risks such as identity theft and targeted phishing attacks may be observed if employee or customer information is exposed. The potential for such secondary attacks is a common concern when sensitive information is exfiltrated during a breach.

Given that the BlackBasta group is assessed to have links to Conti, it may be suggested that the group tends to employ double-extortion tactics. Double extortion is a strategy where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This dual-threat approach increases the pressure on organizations to comply with ransom demands to avoid both operational downtime and reputational damage.

Furthermore, depending on the content of the allegedly leaked data, legal processes under data protection regulations within the organization's sector could be triggered, potentially resulting in reputational damage. Organizations in the manufacturing and construction sectors must remain vigilant against such threats, as the exposure of proprietary designs, client contracts, or employee records can have long-term consequences. Public information regarding the BlackBasta group remains limited, making it difficult to ascertain the full scope of their operational methods.