The Norfolk Capital Group listed on BlackBasta ransomware leak site

• Ransomware group: BlackBasta
• Country: United Kingdom
• Sector: Financial Services
• Announcement date: March 8, 2023

BlackBasta claims a breach at The Norfolk Capital Group

The Norfolk Capital Group has been listed on the leak site of the BlackBasta ransomware group. On March 8, 2023, the threat actor group published an announcement claiming to have targeted the organization. According to the group's claims, they have successfully gained access to the organization's systems and performed a data exfiltration operation.

Ransomware leak sites are platforms used by cybercriminal groups to exert pressure on victims through a method known as double extortion. In these scenarios, attackers do not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This tactic is designed to increase the likelihood of a ransom payment by leveraging the threat of reputational damage and regulatory scrutiny.

Details of the alleged incident

The announcement made by the BlackBasta group on March 8, 2023, details the alleged targeting of The Norfolk Capital Group. While the group claims to have accessed the systems and extracted data, the announcement remains vague regarding the specifics of the operation. No specific details regarding a ransom demand or the volume of the compromised data have been provided in the announcement.

Furthermore, the listing provides no evidence or screenshots regarding the nature of the leaked data. The group has not shared any specific files or visual proof to substantiate their claims of a successful breach at this time.

Organization profile

The Norfolk Capital Group is an investment firm managed by Andrew and Sharon Turner. The group invests in various companies operating within the financial services sector. Operating since 1988, the group manages a portfolio of companies that provide loans and a range of financial product solutions to consumers and SMEs.

Risk assessment and industry implications

The BlackBasta group is a Ransomware-as-a-Service (RaaS) entity that has been active since early 2022. It is assessed to have links to the Conti group. Given that the organization operates in the financial services sector, any potential compromise of sensitive customer financial information or personal data may trigger legal processes under UK GDPR regulations. The alleged breach could create secondary risks for the organization's clients, such as identity theft and targeted phishing attacks.

Based on the group's past operations, it is possible that they may continue to exert pressure through methods such as publishing or selling the data. For organizations operating in the financial sector, maintaining robust security postures is critical to mitigate these risks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent initial access by threat actors.

Summary of claims

• Targeted organization: The Norfolk Capital Group
• Threat actor: BlackBasta
• Claimed action: System access and data exfiltration
• Ransom demand: Not specified
• Data volume: Not specified