EDVMS Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure professional-services firms by stealing internal files and threatening public release, a pattern that has become a routine feature of the current cyber-threat landscape. In late July 2023, the group known as blackbasta added EDVMS to its leak site, asserting that it had exfiltrated internal material during a ransomware attack. The number of people affected remains unknown, and public detail about the incident is limited.

For clients, employees and partners of a regional tax and accounting practice, any confirmed exposure of internal files carries concrete risks of fraud, identity misuse and disruption of trusted professional relationships. What follows is a factual account of what has been reported, what is known about the claimed actor, and the practical steps people can take while fuller information is still unavailable.

Inside the incident

On 25 July 2023 it was reported that EDVMS had been listed by the blackbasta ransomware group. According to the available summary, the group claimed that internal files had been exfiltrated in a ransomware attack. No confirmed figure for the number of people affected has been published, and the precise timing of the intrusion, the initial access method and the full scope of systems involved have not been disclosed in the public record.

The listing itself constitutes a claim by the threat actor rather than an independently verified confirmation of every asserted detail. Organisations named on ransomware leak sites sometimes negotiate, sometimes dispute the claims, and sometimes confirm only limited aspects later; in this case, public detail beyond the reported listing and the description of internal-file exfiltration remains sparse.

Who is blackbasta?

Blackbasta is a ransomware operation that emerged in public reporting in 2022 and has since been associated with double-extortion tactics: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group typically operates a dedicated leak site on which it names victims and, in some cases, posts samples or larger archives of stolen material. Its activity has been documented against organisations across multiple sectors and countries, often focusing on mid-sized enterprises and professional firms that hold sensitive client or operational records.

Like other ransomware crews, blackbasta is understood to rely on common initial-access routes such as compromised credentials, phishing or exploitation of exposed services, followed by lateral movement and data staging before encryption. None of these general patterns should be read as confirmed specifics of the EDVMS incident; they describe only the group’s established public profile. With respect to EDVMS, the sole concrete assertion in the reported facts is the leak-site listing and the claim that internal files were taken.

EDVMS and its sector

EDVMS is described in the reported material in connection with BSB-Steuerberatungsgesellschaft mbH, a German tax-advisory practice that has served companies and private individuals for more than thirty years. The firm concentrates on commercial tax advice, payroll accounting and support for agricultural and forestry businesses. It maintains a headquarters in Münster and approximately twenty-five branches across the Münsterland and Westfalen-Lippe regions, employing more than 650 staff and emphasising close, regional client relationships.

Tax-advisory and payroll firms occupy a position of high trust. They routinely handle financial statements, tax filings, employee wage data, business structures and personal identifying information belonging to both corporate clients and private individuals. A breach affecting such an organisation is consequential because the data involved can be used for targeted fraud, tax-related identity theft or competitive intelligence, and because disruption of payroll or filing services can immediately affect many third parties who never had a direct relationship with the attacker.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, record counts or specific data categories has been publicly disclosed. Exact contents therefore remain unconfirmed.

Organisations of this kind typically hold client tax records, payroll and social-insurance data, contracts, internal correspondence, accounting ledgers and personal details of employees and mandants. Whether any or all of those categories were among the files blackbasta claims to have taken is not established in the available reporting. Until the organisation or independent investigators provide a clearer inventory, any assumption about precise data elements would be speculative.

What's at stake

For individuals whose information may have been present in internal files, the practical risks include phishing or social-engineering attempts that reference real tax or employment details, fraudulent filings or benefit claims, and longer-term identity misuse. Business clients face possible exposure of financial positions, supplier or employee data, and the administrative burden of reviewing their own records and notifying affected parties if required by law.

For EDVMS itself, the stakes include operational disruption, regulatory notification duties under data-protection rules, potential contractual liability toward clients, and reputational damage that can erode the trust on which a regional advisory practice depends. Because the number of people affected is unknown and the precise data set is undisclosed, the full scale of these risks cannot yet be quantified; the absence of public numbers does not imply the absence of harm.

What to do if you're exposed

If you are a client, employee or partner of EDVMS or the related tax-advisory practice, treat any unexpected communication that references your tax, payroll or personal details with caution. Monitor financial and tax accounts for unusual activity, consider placing fraud alerts with relevant credit or identity services where available, and retain copies of any official breach notifications you receive. Change passwords on related accounts and enable multi-factor authentication where it is offered.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for personal monitoring while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.