CORNERSTONE Listed by blackbasta Ransomware Group

On September 20, 2022, CORNERSTONE appeared on the leak site operated by the Black Basta ransomware group. The listing states that the organization suffered a ransomware attack in which internal files were exfiltrated. The group claims to have stolen company data and is using the public posting to pressure CORNERSTONE for payment. The exact number of records involved and the specific systems breached remain undisclosed in the listing.

Reported Details from the Leak Site

The Black Basta leak page for CORNERSTONE states that the victim was listed after refusing or failing to meet the group’s extortion demands. It states that internal files were exfiltrated during a ransomware incident. The disclosure does not quantify how many files or records were taken, nor does it name the precise data types such as customer records, employee information, or financial documents. A countdown timer typical of the group’s playbook was displayed, after which the actors threatened to publish the full archive if no agreement was reached. Public mirrors of the leak site, including ransomware.live, preserve this original posting at https://www.ransomware.live/id/Q09STkVSU1RPTkVAYmxhY2tiYXN0YQ==.

Why This Matters for You and Your Family

When a company that holds personal data about customers, patients, employees, or vendors is hit, the information stolen can directly affect ordinary people. Even though the listing does not detail what was taken, internal files from any organization routinely contain names, addresses, dates of birth, Social Security numbers, medical records, or payment information. Once that material leaves the victim’s control, it circulates among criminal networks where it can be used for identity theft, tax fraud, or targeted phishing against you and your family. The uncertainty itself creates risk: you cannot defend against a breach you do not know exists.

Doxxing and Identity-Chain Implications

Stolen internal files frequently include email addresses, usernames, and internal notes that link seemingly unrelated accounts. Attackers chain these fragments together—pairing a work email with a personal phone number, then locating associated gaming handles or family-member profiles. The result is a detailed dossier that can be sold or used to harass, impersonate, or blackmail. Credential leaks of this kind often cascade into account takeovers on personal services, including children’s gaming accounts that reuse the same passwords or recovery emails. A single breach can therefore expose an entire household’s digital footprint.

Black Basta’s Known Track Record

Public reporting attributes the first appearance of Black Basta to early 2022. The group rapidly gained notoriety for double-extortion attacks that combine encryption of victim networks with the threat to publish stolen data. Notable prior victims have included healthcare providers, manufacturers, and professional-services firms. Their typical playbook begins with initial access gained through compromised remote-desktop credentials or phishing, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. After encryption they wait a short period before listing the victim on their leak site, using escalating deadlines and sample file releases to increase pressure. The exact name “Black Basta” should be watched on threat trackers because the actors continue to evolve their tooling and naming conventions.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used at CORNERSTONE or related services anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or recovery details leaked in incidents like this.
• Let remediation specialists handle takedown requests for any exposed personal documents or broker listings that surface from the Black Basta archive.

The speed with which ransomware groups move stolen data means ordinary families must treat every corporate breach as a personal exposure event. Starting proactive defense now limits how much attackers can build on this incident later. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers.