fote.com Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 12, 2024, the website fote.com, operated by Fruit of the Earth, was listed by the ransomware group known as blackbasta. Public reporting indicates that internal files were claimed to have been exfiltrated in a ransomware attack, with an asserted data volume of approximately 990 GB. The number of people affected remains unknown, and independent confirmation of the full scope has not been detailed in available records.

This listing matters because it involves a long-established consumer products company whose operations handle employee and financial records. When such material is claimed to have been taken, the practical risks center on potential misuse of personal and business information rather than on speculation about motives or unstated technical details.

Inside the incident

According to the reported summary, Fruit of the Earth, doing business through fote.com, appeared on blackbasta’s leak site. The group claims that internal files were exfiltrated as part of a ransomware attack and lists a total data size of roughly 990 GB. The concrete categories named in connection with the listing are financial data, accounts, payroll, and personal employee data and documents. No public timeline of initial access, encryption events, or negotiation has been provided, and the exact method of intrusion remains undisclosed. The number of individuals whose information may be involved is listed as unknown. These details rest on the group’s claim and the contemporaneous reporting of the listing; they have not been independently verified in the available facts.

Who is blackbasta?

Blackbasta is a ransomware group that has operated since 2022 and is known for double-extortion tactics: encrypting systems while also exfiltrating data and threatening to publish it if a ransom is not paid. The group typically gains access through compromised credentials, phishing, or exploitation of remote-access services, then moves laterally to locate high-value file shares and backups. It has previously listed a range of mid-sized and larger organizations across manufacturing, professional services, and consumer goods. Public reporting consistently describes blackbasta as a financially motivated actor rather than a state-sponsored one. In this case, the group’s leak-site listing of fote.com constitutes a claim that data was taken; the facts do not state that the claim has been independently validated or that any specific ransom demand was met or rejected.

About fote.com

Fruit of the Earth is a family-owned skin-care company founded in 1980 and headquartered at 3325 W Trinity Blvd, Grand Prairie, Texas. It specializes in aloe-vera and nature-inspired products for skin care, sun care, and related health-care categories, and it emphasizes ethical sourcing and environmentally conscious production. The company maintains a public website at www.fote.com and can be reached at (817) 510-1600. Organizations of this type routinely hold employee personnel files, payroll records, financial accounts, supplier contracts, and product-formulation data. A breach involving such material is consequential because it can expose both workforce privacy and operational continuity for a firm that supplies consumer goods through retail and wholesale channels.

What data was at risk

The facts name the following categories as claimed to have been exfiltrated:

• Financial data, accounts, and payroll records
• Personal employee data and documents
• Internal files totaling approximately 990 GB

Exact file inventories, the presence or absence of customer records, and any further classification of the material remain unconfirmed beyond the group’s listing. Companies in the personal-care manufacturing sector typically store employee identification details, compensation information, banking coordinates for payroll, and internal accounting ledgers; whether those specific items were among the claimed 990 GB cannot be stated as verified fact from the available record.

The real-world impact

For employees, the primary risks include identity theft, fraudulent tax filings, or targeted phishing that leverages payroll or personal documents. Financial and account data, if misused, could facilitate unauthorized transactions or business-email compromise attempts against the company or its vendors. Fruit of the Earth itself faces potential operational disruption, regulatory notification obligations under applicable privacy laws, and the cost of forensic review and system restoration. Because the number of affected individuals is unknown and the precise contents remain unconfirmed, the scale of individual harm cannot be quantified from public facts alone. The impact is therefore best understood as elevated risk rather than as a catalog of proven harms.

Were you affected?

If you are a current or former employee of Fruit of the Earth, or if you have reason to believe your information was held by the company, treat the listing as a prompt for caution rather than as proof of compromise. Monitor bank and credit statements for unfamiliar activity, place fraud alerts with the major credit bureaus if you notice anomalies, and be wary of unsolicited messages that reference payroll or internal company details. Change passwords on any accounts that may have reused credentials associated with work email. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this incident remains limited; further official statements from the company, if issued, will provide the most reliable next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.