RansomHub ransomware group lists basarsoft.com.tr on its leak site

• Ransomware group: RansomHub
• Country: Türkiye
• Sector: Technology
• Announcement date: October 15, 2024

The RansomHub ransomware group has published a listing on its dedicated leak site claiming responsibility for a data breach involving the Turkish technology company Basarsoft. The announcement, which appeared on October 15, 2024, suggests that the threat actor group has gained unauthorized access to the organization's digital infrastructure.

The alleged attack and claims by RansomHub

According to the announcement made by RansomHub on October 15, 2024, the group has targeted Basarsoft and has released various files that they allege belong to the organization. The group claims to have successfully breached the company's digital environment, gaining access to internal systems. While the group has listed the company on its leak site, the specific details regarding the total volume of data stolen or the specific ransom demand have not been disclosed in the public announcement.

The group provided several screenshots as evidence of the breach. These visual proofs suggest that the compromised information includes documents related to the company's operational processes. This type of activity is characteristic of modern ransomware operations, where attackers move beyond simple encryption to a model known as double extortion. In a double extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it publicly if the ransom is not paid.

Data types involved in the leak

The files released or showcased by the RansomHub group appear to contain a variety of sensitive organizational and operational information. Based on the screenshots provided in the leak site announcement, the following types of data are reportedly involved in the breach:

• Project data
• Employee work schedules
• Corporate insurance policies
• Geographic information system data

The presence of such diverse data types suggests a significant intrusion into the company's internal repositories. The exposure of project-specific information and specialized mapping data is particularly notable given the nature of the company's business operations.

About Basarsoft

Basarsoft is a Turkish technology company that has been established since 1997. The organization specializes in several highly technical fields, including geographic information systems (GIS), digital mapping, and spatial data analysis. Basarsoft provides a wide range of software development and data management solutions to various critical sectors, including telecommunications, transportation, and the government sector.

Risk assessment and industry implications

This potential leak carries several significant risks for the organization. The exposure of internal documents could lead to the disclosure of Basarsoft's trade secrets and sensitive operational data. Furthermore, the inclusion of employee-related information, such as work schedules, increases the risk of identity theft or the execution of targeted phishing attacks against the company's staff. Such attacks often use stolen personal details to gain further access to corporate networks or to deceive employees into revealing more credentials.

From a regulatory perspective, the company may be required to fulfill data breach notification obligations under the Law on Protection of Personal Data (KVKK) in Türkiye. Additionally, because the scope of the leak could impact the company's business partners and clients, there are indirect security risks posed to the broader ecosystem of the organization's professional network.

In the technology and GIS sectors, maintaining the integrity of spatial data and project codes is vital. Organizations facing such threats often prioritize strengthening their perimeter defenses, implementing strict access controls, and ensuring robust encryption for data at rest and in transit. Given the reported ties between RansomHub and the ALPHV group, the use of double-extortion tactics is a significant consideration for incident response teams managing such breaches.