CREMO Listed by Black Basta Ransomware Group

On August 06, 2022, cosmetics and personal-care company CREMO appeared on the leak site operated by the Black Basta ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, although the exact number of records affected and the specific types of data taken remain undisclosed by the group.

Primary Disclosure Details

The Black Basta leak site entry for CREMO states that the company was hit by a ransomware operation and that attackers successfully removed internal files before encrypting systems. The disclosure does not quantify the volume of data, list the file types exposed, or reveal any ransom demand. It simply states that data was stolen and gives CREMO a deadline to negotiate or face full publication. Public copies of the listing, archived on ransomware.live, show the same limited details that have been consistent since the initial post.

Why This Matters for You and Your Family

When a company that sells everyday personal-care products suffers a breach, the information taken often includes customer records, supplier contracts, employee payroll files, or internal correspondence that can contain names, addresses, dates of birth, and payment details. Even though the exact contents are unknown, any leak of internal files creates immediate risk for anyone whose data touched CREMO’s systems. Employees, customers, and vendors could see their information sold or dumped publicly, leading to spam, identity theft attempts, or targeted scams that feel personal because the attackers know details only the company should hold.

Doxxing and Identity-Chain Risks

Stolen internal files frequently contain spreadsheets that link employee or customer identities to email addresses, phone numbers, and sometimes even passwords or security-question answers. Once that data reaches dark-web markets or other ransomware leak sites, it becomes raw material for doxxing chains. A single leaked work email can be cross-referenced with gaming accounts, social-media handles, or family addresses, allowing attackers to map an entire household. Credential leaks like this one regularly cascade into account takeovers on Steam, Roblox, or other platforms children use, exposing family photos, chat logs, and location data that should never leave the home.

Black Basta’s Known Track Record

Public reporting attributes the first Black Basta activity to early 2022. The group rapidly gained notoriety for double-extortion attacks that combine ransomware encryption with threats to publish stolen data. Notable prior victims include large manufacturers, healthcare providers, and technology firms. Their typical playbook begins with initial access gained through compromised remote-desktop credentials or phishing, followed by rapid lateral movement, data exfiltration over several days, and then deployment of their signature ransomware. After encryption they wait a short period before listing the victim on their leak site with a countdown, offering to delete the data only if a ransom is paid. The group has continued this pattern across dozens of incidents, showing both discipline and willingness to publish when negotiations fail.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the CREMO breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught and handled in hours rather than months.
• Rotate any password you used at CREMO or any related vendor account, then switch to 2FA through an authenticator app instead of text messages.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts where credential leaks often lead to takeovers and further doxxing.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise consume weeks of your own time.

The CREMO listing is another reminder that ransomware groups move quickly and publish without hesitation when payments are not made. Protecting yourself means treating every breach that touches your information as a live threat rather than yesterday’s news. Start your DoxxScan trial today and combine continuous monitoring, identity-chain mapping, and hands-on specialist remediation to shield both your own records and those of your family, including gaming accounts that attackers love to hijack.