Northern Safety Co. Hit by Major BlackBasta Ransomware Attack
Incident Date:
September 16, 2024
Overview
Title
Northern Safety Co. Hit by Major BlackBasta Ransomware Attack
Victim
Northern Safety Co., Inc.
Attacker
Blackbasta
Location
First Reported
September 16, 2024
Ransomware Attack on Northern Safety Co., Inc. by BlackBasta
Northern Safety Co., Inc., a leading distributor of safety equipment and industrial supplies, has been targeted by the notorious ransomware group BlackBasta. The attack has compromised approximately 750GB of data, including corporate data, financial records, human resources information, and personal, confidential data of users and employees. This breach significantly impacts the company's operations and potentially exposes sensitive information stored at their headquarters in Memphis, TN.
About Northern Safety Co., Inc.
Founded in 1983, Northern Safety Co., Inc. has grown from selling first aid supplies and gloves from a pickup truck to becoming a prominent player in the safety equipment industry. The company offers over 100,000 core products, including personal protective equipment (PPE), first aid kits, disposable respirators, and various industrial supplies. Their extensive inventory allows for same-day shipping from multiple locations across the United States, ensuring businesses can quickly access the safety products they need.
In addition to its product offerings, Northern Safety provides specialized services such as equipment rentals, maintenance, inspections, and repairs through its Technical Services department. The NSI Inventory Solutions service helps businesses streamline their inventory processes, reducing waste and improving efficiency. The company also emphasizes compliance with occupational safety standards, providing resources and training related to OSHA regulations.
Attack Overview
The ransomware attack orchestrated by BlackBasta has compromised a significant amount of data, affecting Northern Safety's operations and potentially exposing sensitive information. The attack highlights the vulnerabilities that even well-established companies face in the digital age. The breach underscores the importance of cybersecurity measures, especially for companies handling large volumes of sensitive data.
About BlackBasta
BlackBasta is a ransomware operator and Ransomware-as-a-Service (RaaS) criminal enterprise that emerged in early 2022. The group is believed to have connections to the defunct Conti threat actor group. BlackBasta targets organizations in highly targeted attacks, employing a double extortion tactic where they encrypt critical data and threaten to publish sensitive information if the ransom is not paid.
The group uses various methods to gain initial access to target networks, including spear-phishing campaigns, insider information, and buying network access. Once inside, they use tools like QakBot and Mimikatz for lateral movement and credential harvesting. For maintaining control over compromised systems, BlackBasta employs tools like Cobalt Strike Beacons and SystemBC. Before encrypting files, they disable security tools, delete shadow copies, and exfiltrate sensitive data.
Penetration and Impact
BlackBasta's ability to penetrate Northern Safety's systems could be attributed to several factors, including potential vulnerabilities in the company's cybersecurity infrastructure. The group's sophisticated tactics and tools make them a formidable threat to organizations across various sectors. The financial and operational impact of such attacks can be substantial, as evidenced by previous incidents involving other high-profile victims.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.