In a recent cyber threat, the notorious Black Basta ransomware group has claimed responsibility for hacking into Southern Water, a prominent UK water utility company. Southern Water, a private entity, operates in Hampshire, the Isle of Wight, West Sussex, East Sussex, and Kent, providing wastewater collection and treatment services and supplying public water to nearly half of this region.

The hacker group added Southern Water to its list of victims on the Tor data leak site, threatening to expose the stolen data on February 29, 2024. The compromised data reportedly includes 750 gigabytes of sensitive information, such as personal and corporate documents. Screenshots posted by the group reveal some employees’ passports, ID cards, and personal details.

As of now, the specific ransom demanded by the Black Basta group remains unknown. Employing a double-extortion attack model, the group typically demands payment from victims under the threat of exposing sensitive information.

This recent breach follows a revelation by independent security researchers from SRLabs, who identified a vulnerability in the Black Basta ransomware’s encryption algorithm earlier this month. In response, the researchers developed a free decryptor after exploiting the flaw.

Black Basta has been active since April 2022, accumulating over $107 million in Bitcoin ransom payments. A joint study by Elliptic and Corvus Insurance found that the group infected at least 329 victims, including well-known entities like ABB, Capita, Dish Network, and Rheinmetall. Further analysis of blockchain transactions indicates a connection between Black Basta and the now-discontinued Conti Group, with funds laundered through the Russian crypto exchange Garantex.

SRLabs’ analysis of the ransomware’s encryption algorithm reveals a weakness exploited around April 2023. Files below 5,000 bytes in size are unrecoverable, while full recovery is possible for files between 5,000 bytes and 1GB. However, a recent fix implemented by Black Basta limits the effectiveness of the decryption technique, rendering it unusable for attacks after December 2023.