hvd.host Listed by blackbasta Ransomware Group

On February 22, 2024, the ransomware group Black Basta added hvd.host to its public leak site, listing Hosted Companies as the victim and claiming to have exfiltrated roughly 700 GB of internal files. The disclosure indicates that data taken includes accountings, financial records, personal employee documents, and legal materials from multiple Australian and UK brands hosted by the company, such as australiantextiles.com.au, ausweave.com.au, bartgroup.com.au, bruck.com.au, opt.net.au, wilsonfabrics.com, knoxbridge.com.au, novaemployment.com.au, primrose.co.uk, xenit.com.au, advancedcs.com.au, therose.pub, and localbar.com.au. The exact number of individuals whose information appears in the files remains unknown.

Details from the Leak Site

The Black Basta leak page states that Hosted Companies suffered a ransomware attack in which attackers exfiltrated internal files before encrypting systems. It lists the specific data categories noted above and provides a total size of the stolen archive. The disclosure does not quantify how many employee or customer records are contained in the 700 GB, nor does it specify the precise date of initial compromise. A direct link to the onion site was indexed by ransomware.live, making the listing publicly verifiable as of late February 2024.

Why This Matters for You and Your Family

If you or anyone in your household works at one of the listed companies, or if your personal documents were stored in their shared systems, your information may now sit on a criminal data marketplace. Personal employee documents and financial data are high-value targets for identity thieves. Even when a breach notification has not yet reached you, the public listing means opportunistic criminals have had weeks to download and begin exploiting the material. For families, this risk extends beyond the employee to spouses, children, and shared addresses that appear in payroll or benefits files.

The Doxxing and Identity-Chain Risks

Leaked internal files often contain spreadsheets that link names, dates of birth, addresses, phone numbers, email accounts, and sometimes national identification numbers. Once criminals possess these, they can map your digital footprint across dozens of services. A single exposed work email can lead to credential-stuffing attacks on personal banking, shopping, or social-media accounts. Public reporting shows that such leaks frequently cascade into full doxxing chains where attackers publish your home address, family member names, and even children’s details to increase pressure or sell the package to other threat actors. Credential leaks like this one also threaten gaming accounts belonging to you or your children, because reused passwords and linked recovery emails allow attackers to seize those identities and further expand the chain.

Black Basta’s Known Track Record

Public reporting attributes the first Black Basta ransomware operations to early 2022. The group rapidly gained notoriety for targeting mid-sized businesses across North America, Europe, and Australia. Notable prior victims include large manufacturers, healthcare providers, and technology service firms. Their typical playbook involves gaining initial access through compromised remote desktop credentials or phishing, exfiltrating data quietly for weeks, then deploying ransomware that both encrypts files and threatens public release. Black Basta usually demands payment in bitcoin and maintains a dual extortion model: payment to decrypt systems plus a separate fee to prevent data publication on their leak site. The exact success rate of their extortion remains unclear, but the volume of victims listed on their onion portal indicates the tactic remains effective for them.

What to do

• Run a DoxxScan to map every link between your work and personal emails, phone numbers, addresses, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Rotate every password that was used at any Hosted Companies domain or service and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and acted on within hours.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains when parent credentials are exposed.
• Let DoxxScan remediation specialists handle data-broker takedown requests and removal of any exposed personal documents on your behalf.

The exposure of Hosted Companies’ internal files shows how quickly a single vendor breach can place ordinary families in the crosshairs of organized ransomware operators. Acting promptly on the exposed data categories can limit how far criminals push the stolen information. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.