blackbasta
First seen April 26, 2022Active525 claimed victims
The claims below are reproduced as posted by blackbasta on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| migonline.com | January 11, 2025 | ransomware_live | — |
| medion.com | December 18, 2024 | ransomware_live | — |
| bnext.nl | December 17, 2024 | ransomware_live | — |
| avril.ca | December 12, 2024 | ransomware_live | — |
| plasmatherm.com | December 12, 2024 | ransomware_live | — |
| brachot.com | December 11, 2024 | ransomware_live | — |
| arunestates.co.uk | December 10, 2024 | ransomware_live | — |
| bathfitter.com | December 5, 2024 | ransomware_live | — |
| vossko.de | December 4, 2024 | ransomware_live | — |
| snatt.it | December 4, 2024 | ransomware_live | — |
| grimaldialliance.com | November 27, 2024 | ransomware_live | — |
| valveworksusa.com | November 26, 2024 | ransomware_live | — |
| wikov.com | November 21, 2024 | ransomware_live | — |
| granbyindustries.com | November 21, 2024 | ransomware_live | — |
| activedynamics.com | November 20, 2024 | ransomware_live | — |
| schuff.com | November 20, 2024 | ransomware_live | — |
| lornestewartgroup.com | November 14, 2024 | ransomware_live | — |
| medicacorp.com | November 13, 2024 | ransomware_live | — |
| fote.com | November 12, 2024 | ransomware_live | — |
| rembe.de | November 4, 2024 | ransomware_live | — |
| gfemlaw.com | October 31, 2024 | ransomware_live | — |
| beko-technologies.com | October 31, 2024 | ransomware_live | — |
| bender.de | October 31, 2024 | ransomware_live | — |
| westbankcorp.com | October 29, 2024 | ransomware_live | — |
| btci.com | October 25, 2024 | ransomware_live | — |
| cafezupas.com | October 24, 2024 | ransomware_live | — |
| g-s.co.uk | October 24, 2024 | ransomware_live | — |
| rauch.de | October 23, 2024 | ransomware_live | — |
| andyfrain.com | October 23, 2024 | ransomware_live | — |
| isaitaly.com | October 22, 2024 | ransomware_live | — |
| hamptonsecurities.com | October 22, 2024 | ransomware_live | — |
| jonti-craft.com | October 18, 2024 | ransomware_live | — |
| continentalserves.com | October 18, 2024 | ransomware_live | — |
| eatonmetal.com | October 17, 2024 | ransomware_live | — |
| mcleanmortgage.com | October 17, 2024 | ransomware_live | — |
| interspiro.com | October 17, 2024 | ransomware_live | — |
| wachter.com | October 16, 2024 | ransomware_live | — |
| instinctpetfood.com | October 16, 2024 | ransomware_live | — |
| suit-kote.com | October 16, 2024 | ransomware_live | — |
| kmcglobal.com | October 14, 2024 | ransomware_live | — |
| celo.com | October 10, 2024 | ransomware_live | — |
| daserv.com | October 10, 2024 | ransomware_live | — |
| furmanos.com | October 10, 2024 | ransomware_live | — |
| rosenlegal.com | October 9, 2024 | ransomware_live | — |
| gkcorp.com | October 8, 2024 | ransomware_live | — |
| weberpackaging.com | October 8, 2024 | ransomware_live | — |
| rockportmortgage.com | October 5, 2024 | ransomware_live | — |
| lewa.com | October 3, 2024 | ransomware_live | — |
| milleredge.com | October 3, 2024 | ransomware_live | — |
| ssbwc.com | October 2, 2024 | ransomware_live | — |
| gfm-uk.com | October 1, 2024 | ransomware_live | — |
| tuggleduggins.com | October 1, 2024 | ransomware_live | — |
| temple-inc.com | September 28, 2024 | ransomware_live | — |
| caseparts.com | September 27, 2024 | ransomware_live | — |
| lambertz.de | June 30, 2024 | ransomware_live | — |
| usdermpartners.com | June 18, 2024 | ransomware_live | — |
| atos.com | June 17, 2024 | ransomware_live | — |
| hpecds.com | June 14, 2024 | ransomware_live | — |
| memc.com | June 11, 2024 | ransomware_live | — |
| thompsoncreek.com_wa | June 10, 2024 | ransomware_live | — |
| thompsoncreek.com | June 10, 2024 | ransomware_live | — |
| scrubsandbeyond.com | June 8, 2024 | ransomware_live | — |
| grupoamper.com | June 7, 2024 | ransomware_live | — |
| northernsafety.com_wa | June 7, 2024 | ransomware_live | — |
| northernsafety.com | June 7, 2024 | ransomware_live | — |
| driver-group.com | June 6, 2024 | ransomware_live | — |
| posiplus.com | June 6, 2024 | ransomware_live | — |
| dynasafe.com | June 3, 2024 | ransomware_live | — |
| keybenefit.com | May 29, 2024 | ransomware_live | — |
| mgfsourcing.com | May 28, 2024 | ransomware_live | — |
| modplan.co.uk | May 28, 2024 | ransomware_live | — |
| pkaufmann.com | May 24, 2024 | ransomware_live | — |
| elutia.com | May 22, 2024 | ransomware_live | — |
| levian.com | May 21, 2024 | ransomware_live | — |
| wielton.com.pl | May 16, 2024 | ransomware_live | — |
| robson.com | May 13, 2024 | ransomware_live | — |
| olsonsteel.com | May 7, 2024 | ransomware_live | — |
| atlasoil.com | May 7, 2024 | ransomware_live | — |
| keytronic.com | May 6, 2024 | ransomware_live | — |
| synlab.com | May 4, 2024 | ransomware_live | — |
| swisspro.ch | May 4, 2024 | ransomware_live | — |
| grupocadarso.com | May 4, 2024 | ransomware_live | — |
| thelawrencegroup.com | May 3, 2024 | ransomware_live | — |
| trugreen.com | May 3, 2024 | ransomware_live | — |
| ssiworld.com | May 3, 2024 | ransomware_live | — |
| akdenizchemson.com | May 3, 2024 | ransomware_live | — |
| thelawrencegroup.com_privat | April 27, 2024 | ransomware_live | — |
| ayesa.com | April 24, 2024 | ransomware_live | — |
| mfgroup.it | April 24, 2024 | ransomware_live | — |
| talalayglobal.com | April 24, 2024 | ransomware_live | — |
| active-pcb.com | April 19, 2024 | ransomware_live | — |
| teaspa.it | April 19, 2024 | ransomware_live | — |
| gai-it.com | April 18, 2024 | ransomware_live | — |
| lactanet.ca | April 10, 2024 | ransomware_live | — |
| bdcm.com | April 9, 2024 | ransomware_live | — |
| hymer-alu.de | April 4, 2024 | ransomware_live | — |
| cavotec.com | April 4, 2024 | ransomware_live | — |
| doyon.com | doyondrilling.com | April 2, 2024 | ransomware_live | — |
| fluenthome.com | April 2, 2024 | ransomware_live | — |
| ids-michigan.com | April 2, 2024 | ransomware_live | — |
Page 1 of 6Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).