A.R. Thomson Group Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 09, 2022, A.R. Thomson Group appeared on the leak site operated by the blackbasta ransomware group. The group claims to have stolen internal data from the organisation in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the claim has been widely reported.

Listings of this kind matter because they signal that an organisation’s systems may have been compromised and that internal material could be at risk of wider exposure. For employees, partners, and others connected to A.R. Thomson Group, the practical question is what, if anything, has left the organisation’s control and what steps are available while fuller details are still undisclosed.

Inside the incident

According to the available record, A.R. Thomson Group was listed on the blackbasta ransomware leak site on or around December 09, 2022. The group claims to have exfiltrated internal files in the course of a ransomware attack. No further operational detail—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted—has been publicly confirmed in the facts at hand.

The scale of the incident is likewise undisclosed. There is no public figure for the number of individuals whose information may be involved, and no verified inventory of the specific files or systems affected. What is known is limited to the leak-site listing itself and the group’s assertion that internal data was stolen. Until the organisation or independent investigators provide additional confirmed information, the precise scope and timeline remain unconfirmed.

Who is blackbasta?

Blackbasta is a ransomware operation that emerged in public reporting in 2022 and has been associated with double-extortion tactics: encrypting systems while also claiming to steal data and threatening to publish it if demands are not met. The group has typically operated as a ransomware-as-a-service style enterprise, with affiliates carrying out intrusions and the core operation managing negotiation and leak-site infrastructure.

Like other groups in this category, blackbasta has historically targeted a range of organisations across industries, often after gaining access through common vectors such as compromised credentials, phishing, or exploitation of exposed services. Listings on its leak site are claims by the group; they do not by themselves constitute independent verification that every asserted detail is accurate. In this case, the facts state only that A.R. Thomson Group was listed and that blackbasta claims to have stolen internal data. No additional claims specific to this victim beyond that listing are part of the confirmed record here.

A.R. Thomson Group and its sector

A.R. Thomson Group is a company active in industrial sealing and fluid-handling products—gaskets, seals, packing, and related components used across manufacturing, energy, process industries, and other heavy commercial settings. Organisations of this type typically maintain supplier and customer records, engineering and product documentation, internal operational files, employee information, and commercial correspondence.

A breach affecting such a firm is consequential because industrial suppliers sit in supply chains that depend on reliable technical data, contracts, and continuity of operations. Exposure of internal files can affect not only the company itself but also counterparties who share drawings, specifications, pricing, or logistics information. Even when the exact contents of a claimed theft remain unconfirmed, the sector context explains why listings of this kind draw attention from partners, insurers, and individuals whose details may appear in corporate systems.

The information in question

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No itemised list of data types—such as names, contact details, financial records, or technical documents—has been publicly confirmed in the available record. The precise contents therefore remain unconfirmed.

Organisations in this sector commonly hold employee and contractor records, customer and supplier contact information, order and shipping data, engineering drawings, quality documentation, and internal business correspondence. It is reasonable to expect that some combination of such material could exist within internal file stores, but it would be inaccurate to state that any specific category was taken in this incident. Until verified disclosures appear, the only established description is the group’s claim of stolen internal files.

What's at stake

For people whose information may have been held by A.R. Thomson Group, the practical risks depend on what was actually present in the exfiltrated material. If personal or contact data were included, individuals could face phishing, social-engineering attempts, or unwanted contact that leverages knowledge of a business relationship. If commercial or technical files were involved, counterparties might face competitive or operational exposure. None of these outcomes is confirmed by the current public facts; they are the ordinary categories of harm that follow when internal corporate data leaves an organisation’s control.

For the organisation, a ransomware listing can bring operational disruption, investigative and recovery costs, notification obligations where applicable, and reputational pressure from customers and partners seeking assurance. Because the number of people affected is unknown and the exact data types are not itemised beyond “internal files,” the concrete impact on any given individual or partner cannot yet be stated with precision. Caution and verification remain the appropriate responses rather than assumption of worst-case outcomes.

Were you affected?

If you have a past or present relationship with A.R. Thomson Group—as an employee, contractor, customer, or supplier—treat unsolicited messages that reference the company or this incident with care. Prefer official channels for any verification. Monitor financial and email accounts for unusual activity, and consider placing fraud alerts where appropriate if you believe sensitive personal data may have been involved. Because the public record does not identify who, if anyone, was specifically affected, there is no confirmed list of individuals to check against.

You can also run a free exposure scan of your email address to see whether it has already appeared in known breach datasets. That step does not confirm involvement in this particular incident, but it can indicate whether your address has surfaced elsewhere and help you prioritise password changes and further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.