BASF - Nunhems Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target industrial and agricultural firms, using double-extortion tactics that combine encryption with data theft and public leak-site listings. In this environment, even partial disclosures of internal material can create lasting operational and personal risks for organisations and the people connected to them.

On 29 July 2024, the ransomware group known as fog listed BASF - Nunhems as a victim, claiming to have exfiltrated 30 GB of internal files. The number of people affected remains unknown, and public detail beyond the group’s claim is limited. The listing itself is an unverified assertion by the attackers; it nevertheless warrants careful attention because of the nature of the organisation and the type of material typically held by seed-breeding and agricultural-research businesses.

Inside the incident

According to the available record, fog publicly listed BASF - Nunhems on its leak site on 29 July 2024. The group stated that it had conducted a ransomware attack in which internal files were exfiltrated, with the volume of data claimed to be 30 GB. No further technical details—such as the initial access method, the precise date of intrusion, encryption status of systems, or any ransom demand—have been disclosed in the public facts. The number of individuals whose information may be involved is recorded as unknown. Beyond the group’s own listing, independent confirmation of the breach’s full scope or impact has not been provided in the available material.

The group behind it: fog

Fog is a ransomware operation that became active in the public eye in 2024. Like many contemporary groups, it follows a double-extortion model: after gaining access, operators encrypt systems and simultaneously steal data, then threaten to publish the material on a dedicated leak site if payment is not made. The group has been observed listing victims across manufacturing, professional services and other sectors, typically posting sample files or volume claims to pressure organisations. Public reporting on fog describes the use of common ransomware toolkits and affiliate-style recruitment, though specific tooling and infrastructure can change. In the present case, the only claim attributable to fog regarding BASF - Nunhems is the leak-site listing itself and the associated assertion of 30 GB of internal files; no additional statements by the group about this victim appear in the facts.

Who is BASF - Nunhems?

BASF - Nunhems is the vegetable-seeds business of BASF, the large German chemical and agricultural company. Nunhems specialises in the breeding, production and distribution of vegetable seeds for professional growers worldwide. Organisations of this kind maintain extensive research and development records, proprietary breeding data, supply-chain information, commercial contracts, and employee and customer records. Because seed genetics and agricultural innovation are commercially sensitive and often subject to intellectual-property protections, a breach at such an entity can affect competitive position as well as the privacy of staff, partners and growers who interact with the business. The listing of BASF - Nunhems therefore carries consequences that extend beyond a single corporate network.

The information in question

The facts state that the exposed material consists of internal files exfiltrated in a ransomware attack, with a claimed volume of 30 GB. No more granular inventory—such as specific file categories, databases or personal-data fields—has been publicly named. Organisations in the agricultural-seed sector typically hold research notes, genetic and trial data, employee personnel files, customer and distributor contact lists, financial records and operational documents. Whether any of those categories were present in the claimed 30 GB remains unconfirmed. Exact contents are therefore undisclosed; readers should treat the data types as unknown beyond the general description of internal files.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include potential misuse of personal identifiers, contact details or employment-related data for phishing, identity fraud or social-engineering attempts. For the organisation, the exposure of proprietary breeding or commercial information could undermine competitive advantage and create regulatory or contractual obligations. Even when the precise contents are unconfirmed, the mere public listing can generate reputational pressure and force resource-intensive incident-response and notification work. Because the number of affected people is unknown, the scale of personal impact cannot yet be quantified; the prudent assumption is that any internal material could contain data of value to criminals or competitors.

If your data was in this claimed breach

If you have a past or present connection to BASF - Nunhems—as an employee, contractor, grower, supplier or customer—treat the possibility of exposure seriously even though the exact contents remain unconfirmed. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be alert to unsolicited messages that reference the company or agricultural topics. Consider placing fraud alerts with credit bureaus if you believe personal identifiers may have been involved. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets; such checks provide an additional, independent signal of prior compromise.

AICompiled with AI assistance from public sources and published under our editorial standards.