basarsoft.com.tr Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose information may sit inside Basarsoft’s systems face a practical question: whether internal files taken in a claimed ransomware incident could expose work contacts, project details, or other personal data that later appears in criminal markets. Public reporting so far gives only limited confirmation of what was taken and who is affected, so the immediate stakes remain uncertain rather than proven.

On 15 October 2024 the ransomware group known as ransomhub listed basarsoft.com.tr on its leak site, asserting that internal files had been exfiltrated. The number of people affected is unknown, and no independent verification of the claim has been published. That listing alone is enough to warrant careful attention from anyone who has dealt with the company.

What happened

According to the available record, basarsoft.com.tr was listed by the ransomhub ransomware group on 15 October 2024. The group claims that internal files were exfiltrated during a ransomware attack. No further public detail has been released about the precise date of intrusion, the technical method used, the volume of data removed, or whether any ransom demand was paid. The number of individuals whose information may be involved remains unknown. Because the only source for the incident is the group’s own leak-site listing, the claim should be treated as unverified until corroborated by the company or independent investigators.

The group behind it: ransomhub

Ransomhub is a ransomware operation that became publicly active in 2024, operating on a ransomware-as-a-service model. Affiliates typically gain access to a target network, encrypt systems, and exfiltrate data before posting the victim’s name on a dedicated leak site if payment is not made. The group’s public communications emphasise double-extortion pressure: the threat of releasing stolen files alongside the encryption of operational systems. Prior listings have covered organisations in multiple countries and sectors, though each listing remains a unilateral claim by the group rather than confirmed fact. In the present case, ransomhub’s only documented assertion is that basarsoft.com.tr suffered an attack in which internal files were taken; no additional statements specific to this victim have been reported.

About basarsoft.com.tr

Basarsoft is a Turkish firm established in 1997 that specialises in geographic information systems (GIS) and digital mapping. It develops GIS software, produces digital cartography, and performs spatial data analysis for clients in telecommunications, transportation, and government. Organisations of this type routinely hold project files, customer and partner contact records, mapping datasets, and internal administrative documents. A breach involving such a company is consequential because the data can include both commercial intellectual property and personal identifiers of employees, contractors, and public-sector counterparts. The company has not issued a public statement confirming or denying the ransomhub listing at the time of writing.

What data was at risk

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” No inventory of specific file categories, record counts, or personal-data fields has been disclosed. Companies that supply GIS and mapping services typically store employee directories, client correspondence, project documentation, spatial datasets, and system credentials. Whether any of those categories were among the files claimed by ransomhub is unconfirmed. Readers should therefore treat the precise contents as unknown rather than assume any particular type of personal information was or was not exposed.

What's at stake

For individuals, the practical risks centre on the possible later appearance of contact details, work-related correspondence, or other identifiers in secondary criminal markets. Such material can be used for targeted phishing, social-engineering calls, or identity-related fraud. For the organisation itself, the stakes include potential disruption of mapping and GIS services relied upon by telecom, transport, and government clients, as well as reputational and contractual consequences if sensitive project data were released. Because the scale of the claimed exfiltration remains undisclosed, the actual severity cannot yet be measured.

• Unknown number of people potentially affected
• Only “internal files” publicly named as taken
• No independent confirmation of the leak-site claim
• Possible secondary use of any exposed contact or project data

Were you affected?

If you have worked with Basarsoft, supplied data to it, or appear in its client or partner records, treat the situation as a precautionary matter. Change passwords on any accounts that may have been shared with the company, enable multi-factor authentication where available, and watch for unexpected messages that reference mapping projects or Turkish GIS work. Monitor financial and identity accounts for unusual activity. Public detail on this incident remains limited, so definitive notification may never arrive. As a practical next step, you can run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets; such a scan will not confirm or rule out involvement in this specific event, but it can surface other exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.