Black Basta Strikes: Ayesa's Data Breach Crisis
Incident Date:
May 5, 2024
Overview
Title
Black Basta Strikes: Ayesa's Data Breach Crisis
Victim
Ayesa
Attacker
Blackbasta
Location
First Reported
May 5, 2024
Ransomware Attack on Ayesa by Black Basta Group
Company Profile
Ayesa, a prominent global provider of technology and engineering services, operates with a workforce of over 12,500 employees and maintains a presence in 23 countries across Europe, America, Africa, and Asia. Specializing in a wide array of sectors including utilities and energy, public sector, and transportation, Ayesa is recognized for its innovative digital and engineering solutions. The company's robust integration of technology in infrastructure projects and digital transformation initiatives has marked its standing as a leader in the engineering sector, generating revenues of approximately 700 million euros.
Details of the Ransomware Attack
The Black Basta ransomware group, known for its aggressive cyber-attacks, targeted Ayesa, resulting in the exfiltration of 4.5 TB of sensitive data. This data breach included critical company information, personal documents of employees, and detailed project files. The attack did not specify a ransom demand immediately but led to the leakage of a portion of the data on the dark web, posing severe security and privacy risks to the company and its stakeholders.
Ransomware Group: Black Basta
Emerging in early 2022, Black Basta quickly became notorious in the cybercrime world through its use of sophisticated tactics such as double extortion. This group encrypts victims' data and threatens to publish it unless a ransom is paid. Black Basta's operations are marked by the use of the XChaCha20 encryption algorithm and a unique file-marking system, distinguishing it from other ransomware operators. The group has been linked to other major cybercriminal organizations, suggesting a high level of sophistication and resources.
Potential Vulnerabilities and Entry Points
While specific details of the breach's methodology are not disclosed, Black Basta's known tactics include exploiting network vulnerabilities, phishing attacks, or credential stuffing. Ayesa's extensive digital footprint and significant data repositories make it an attractive target for such sophisticated threat actors.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.