Tri Counties Bank Listed by blackbasta Ransomware Group

On March 19, 2023, Tri Counties Bank appeared on the leak site operated by the Black Basta ransomware group. The listing indicates that internal files were exfiltrated during a ransomware attack on the California-based financial institution, which serves personal, small business, and commercial customers across the state.

Details from the Leak-Site Listing

The Black Basta leak page for Tri Counties Bank states that the attackers obtained internal files after deploying ransomware. The disclosure does not quantify how many customer or employee records were affected, nor does it list specific data types such as account numbers, Social Security numbers, or tax forms. It simply states that data was stolen and is now held for extortion purposes. The bank itself has not yet issued a public notification detailing the scope, leaving the exact volume and sensitivity of the exposed information unknown to the public.

Tri Counties Bank, a subsidiary of TriCo Bancshares with roughly $10 billion in assets, operates branches throughout California and offers online and mobile banking services. Any customer or employee whose information touched the bank’s internal systems during the compromise window could be at risk, even if the precise records taken remain undisclosed.

Why This Matters for You and Your Family

When a regional bank like Tri Counties Bank loses control of internal files, the consequences reach far beyond corporate embarrassment. Customer data held by banks routinely includes names, addresses, dates of birth, Social Security numbers, account details, and transaction histories. Even partial exposure of such information can fuel identity theft, fraudulent loan applications, and tax fraud targeting you or your family members.

Because the leak-site listing does not detail what was taken, you cannot assume your information is safe simply because you have not received a letter. Anyone who maintained accounts, applied for loans, or worked at the bank in recent years should treat this incident as a high-severity exposure of sensitive personal and financial data.

The Doxxing and Identity-Chain Risks

Stolen internal bank files often contain more than isolated records; they can include spreadsheets that link customer identities to email addresses, phone numbers, and sometimes even employee notes. Attackers and subsequent data brokers can combine these fragments with other breaches to build detailed profiles. A single leaked bank record can anchor an identity chain that reveals your home address, family relationships, and online handles.

Credential leaks from financial institutions frequently cascade into account takeovers elsewhere. The same password or security questions used for online banking may protect your email, retirement accounts, or your children’s gaming logins. Once initial access is gained, attackers pivot laterally, turning one breach into persistent access across your digital life and increasing the likelihood of doxxing or extortion attempts aimed at your household.

Black Basta’s Known Track Record

Public reporting attributes the Black Basta ransomware group’s emergence to early 2022. Since then the gang has targeted organizations across North America, Europe, and Australia, encrypting networks and exfiltrating data before demanding payment. Notable prior victims include healthcare providers, manufacturers, and other financial entities. Their typical playbook involves initial access through phishing, remote desktop protocol brute-force, or exploited vulnerabilities, followed by rapid data theft and deployment of their signature ransomware.

Black Basta usually gives victims a short deadline to pay in cryptocurrency, threatening to publish or sell the stolen files if the ransom is not met. The group operates a dual extortion model that combines encryption with public leak-site pressure, a tactic designed to maximize embarrassment and regulatory risk for the victim organization while indirectly heightening exposure for individuals whose data appears in the samples.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from this and prior breaches.
• Rotate any password you used at Tri Counties Bank anywhere else it is reused, and switch to 2FA via an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential chaining from financial breaches.
• Let remediation specialists handle data-broker takedown requests and opt-out processes on your behalf while you focus on securing accounts.

The incident underscores that even established regional banks remain targets, and the data they hold can anchor long-term identity risks for ordinary customers and their families. Starting proactive defense now limits how far attackers can travel down the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts often exploited after credential leaks like this one.