EDVMS Listed by blackbasta Ransomware Group

On July 25, 2023, German tax advisory firm Als BSB-Steuerberatungsgesellschaft mbH appeared on the leak site of the Black Basta ransomware group under the internal identifier EDVMS. The listing states that internal files were exfiltrated during a ransomware attack; the exact number of people affected and the full scope of records remain undisclosed by both the company and the threat actors.

Details from the Leak Site

The primary disclosure on the Black Basta onion portal, archived via ransomware.live, states that data was stolen from EDVMS and is now published for anyone to download. The notification does not quantify affected records, list specific data types beyond “internal files,” or provide a ransom demand figure. Public reporting on Black Basta indicates the group typically posts a sample of stolen data as proof before threatening full publication or sale if payment is not received. No separate breach notification from the company has surfaced detailing what clients or employees may have had exposed.

Why This Matters for You and Your Family

If you or anyone in your household has worked with Als BSB-Steuerberatungsgesellschaft mbH in the past 30 years, your personal financial information, tax returns, payroll data, or agricultural business records may now sit in a publicly accessible ransomware archive. Tax and payroll files contain permanent identifiers—Social Security numbers, dates of birth, addresses, bank details—that do not expire. A single leak like this can fuel years of identity theft, fraudulent loan applications, and targeted phishing aimed at you or your relatives. Even if the leak site does not list every victim count, the regional focus of the firm across Münster and Westfalen-Lippe means thousands of ordinary German families and small farms are likely in scope.

Doxxing and Identity-Chain Risks

Stolen internal files often contain spreadsheets that link client names to email addresses, phone numbers, tax IDs, and sometimes spouse or child details. Threat actors and opportunistic criminals can chain this information with usernames found in other breaches, creating a complete profile that leads to doxxing, SIM-swapping, or account takeovers. Credential leaks of this nature frequently cascade into gaming platforms; children’s accounts tied to a parent’s reused email become easy targets for hijacking, harassment, or further data sales. Once the chain begins, stopping it requires mapping every handle back to the real identity before criminals do it first.

Black Basta’s Known Track Record

Public reporting attributes the first appearance of Black Basta to early 2022. The group has since hit hospitals, manufacturers, and professional-services firms across North America and Europe. Their typical playbook combines initial access through phishing or exploited remote-desktop services, rapid exfiltration of sensitive folders, followed by double-extortion: encryption of victim systems plus public shaming on their leak site. The EDVMS listing fits this pattern exactly—data posted after the victim apparently declined to pay. Researchers tracking the group note that Black Basta often gives victims a short deadline before releasing full archives, although the precise timer for this incident is not stated on the portal.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at Als BSB-Steuerberatungsgesellschaft mbH or related services, and switch on 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household—DoxxScan family protection extends to dependents and children’s gaming accounts that can chain back to the same leaked address or email.
• Let remediation specialists handle ongoing takedown requests for any personal data already appearing on broker sites or forums tied to this claimed breach.

The speed with which ransomware data moves from leak site to underground marketplaces leaves little room for delay. Treating this incident as a permanent addition to your digital footprint is the safest approach. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage—including children’s gaming accounts—gives families the practical tools needed to break those chains before criminals exploit them. Start your DoxxScan trial today and treat every new breach as a manageable event instead of an inevitable disaster.