dasteam.ch Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 21 February 2024, the Swiss staffing firm dasteam.ch was listed by the ransomware group blackbasta, which claimed to have exfiltrated internal files in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the intrusion or the full scope of data taken has been released. The listing itself is a claim by the group rather than a verified disclosure by the company.

For individuals who have dealt with a personnel-placement firm, any exposure of internal records can raise practical concerns about personal and professional information. This account sticks strictly to what has been reported and to established public knowledge of the actor and the sector.

What happened

According to the available record, dasteam.ch was listed by blackbasta on 21 February 2024. The group stated that internal files had been exfiltrated as part of a ransomware attack and indicated a total data volume of 202 GB. The listing referenced categories labelled 1. Kunden, 2. HR, 3. BuHa and a fourth item that was left incomplete in the published summary. No further technical details—such as the initial access method, the precise date of intrusion, or whether encryption was also deployed—have been disclosed in the public facts. The number of individuals potentially affected remains unknown.

Because the information originates from the group’s own leak-site claim, it should be treated as an unverified assertion until corroborated by the organisation or by independent investigation. No statement from dasteam.ch confirming or denying the incident is included in the reported facts.

Who is blackbasta?

Blackbasta is a ransomware group that has operated since roughly 2022 and is known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group maintains a leak site on which it posts victim names and, in some cases, samples or larger archives of stolen material. Public reporting has linked blackbasta to attacks across multiple sectors and countries; its operators typically demand payment in cryptocurrency and have been observed using common initial-access methods such as phishing, compromised credentials or exploitation of known vulnerabilities. These characteristics are drawn from well-documented public analyses of the group’s activity and do not constitute specific claims about the dasteam.ch incident beyond the listing itself.

In this case the group claims to have taken 202 GB of internal files from dasteam.ch. No additional statements attributed to blackbasta about this particular victim appear in the facts provided.

dasteam.ch and its sector

dasteam.ch is the online presence of Das Team AG, a Swiss company based at Innere Margarethenstrasse 2 in Basel. Public descriptions characterise it as a staffing and recruiting firm employing between 101 and 250 people and generating roughly $25 million to $50 million in annual revenue. Its core business, as stated by the company, is the placement and temporary leasing of personnel in construction and related trades, crafts, industry, technology, and medical and care services. The firm has operated since 1987 and presents itself as a personnel consultancy with specialised industry knowledge.

Organisations of this type routinely handle large volumes of personal and professional data belonging to candidates, temporary workers, client companies and their own staff. A breach claim against a mid-sized Swiss recruiter therefore carries potential consequences for people who have registered for jobs, worked on temporary assignments, or done business with the firm, as well as for the company’s own employees and corporate clients.

The information in question

The facts state that internal files were exfiltrated and give a claimed volume of 202 GB. The categories listed are Kunden (customers/clients), HR, BuHa (commonly understood in German-speaking contexts as accounting or bookkeeping) and a fourth category that was not fully specified. Exact file contents, the presence or absence of particular data fields, and whether any of the material has actually been published remain unconfirmed.

Staffing and recruiting firms typically hold curriculum-vitae data, contact details, employment histories, identity documents, payroll and contract information, client company records, and internal financial and human-resources files. Because the precise contents of the claimed 202 GB archive have not been independently verified, it is not possible to state with certainty which of these categories were included or in what form. Readers should therefore treat any assumption about specific personal data as unconfirmed.

What's at stake

If the claimed exfiltration is accurate, individuals whose records appear in customer or HR files could face risks of identity misuse, targeted phishing, or unsolicited contact. Temporary workers and job candidates often supply sensitive personal identifiers and employment histories; exposure of such material can facilitate social-engineering attempts or, in some cases, financial fraud. Client companies whose commercial relationships or personnel needs are documented may also face competitive or contractual concerns.

For the organisation itself, the incident—if substantiated—raises operational, legal and reputational questions under Swiss data-protection rules. The exact number of people affected is unknown, so the scale of any individual impact cannot yet be quantified. No dollar amounts, ransom demands or confirmed publication of the data appear in the reported facts.

What to do if you're exposed

Anyone who has registered with, worked for, or done business with dasteam.ch should monitor personal accounts for unusual activity, review bank and credit statements where relevant, and be cautious of unsolicited messages that reference employment or personal details. Changing passwords on related services and enabling multi-factor authentication where available are sensible immediate steps. Because the full contents of the claimed archive remain unconfirmed, there is no definitive list of affected individuals; treating the situation as a possible rather than proven exposure is therefore appropriate.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a check does not prove or disprove involvement in this specific incident, but it can indicate whether the address has surfaced elsewhere and help prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.