grupoamper.com Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or work details sit inside a Spanish telecommunications firm’s systems now face a concrete possibility that those records have left the company’s control. On 7 June 2024 the ransomware group blackbasta listed grupoamper.com on its leak site, claiming it had taken roughly 650 GB of internal files. The number of individuals affected remains unknown, yet the categories of material named—R&D data, projects, users and employee information—mean that staff, partners and anyone whose details appear in those files could later encounter identity misuse, targeted phishing or competitive exposure of sensitive work.

Public detail is limited to the group’s own claim and the brief description that accompanied it. No independent confirmation of the intrusion method, exact timeline or full contents has been released. What follows therefore sticks strictly to the recorded facts while placing them in the context of how such incidents typically unfold.

Inside the incident

According to the listing dated 7 June 2024, blackbasta asserts that it exfiltrated internal files from grupoamper.com during a ransomware attack. The group states the total volume of data taken is approximately 650 GB and identifies the material as R&D data, projects, users and employee information. No further technical details—such as the initial access vector, the encryption status of systems, or any ransom demand—have been disclosed in the available record. The number of people whose data may be involved is listed as unknown. The organisation itself has not, in the facts provided, issued a public statement confirming or denying the claim.

Because the only source is the threat actor’s leak-site post, the incident must be treated as an unverified assertion until additional evidence appears. What is known is simply that the domain grupoamper.com was named, a data-size figure was given, and the categories of files were sketched in outline.

Inside blackbasta

Blackbasta is a ransomware operation that first drew wide attention in 2022. Like many contemporary groups it follows a double-extortion model: after gaining access it copies data before encrypting systems, then threatens to publish the stolen material if payment is refused. The group typically gains entry through compromised credentials, phishing or unpatched remote-access services, moves laterally inside the network, and stages large volumes of files for exfiltration. Its leak site has previously named organisations across manufacturing, professional services and critical infrastructure in Europe and North America. Claims posted there are the group’s own assertions; they are not independent verification that every file listed was in fact taken or that every victim was successfully compromised.

In the present case blackbasta claims to hold approximately 650 GB belonging to grupoamper.com. No additional statements attributed specifically to this victim—beyond the volume and the high-level file categories—appear in the recorded facts.

About grupoamper.com

Grupoamper.com is the online presence of Amper, a Spanish technology company whose roots reach back to 1951. That year the telecommunications engineer Antonio Peral founded Amper Radio in Salamanca. By the 1960s the firm was mass-producing radio and intercom equipment and had become a recognised specialist in its field. Today the organisation is headquartered at C/ Virgilio 2, Edificio 4, Ciudad de la Imagen, 28223 Pozuelo de Alarcón, Madrid. Its long history in communications hardware and related systems means it routinely handles technical designs, project documentation, customer and supplier records, and the personal data of employees and users of its products or services.

A breach at an organisation of this type therefore touches both commercial intellectual property and ordinary personal information. The company’s sector—telecommunications and electronic systems—makes the loss of R&D and project files particularly sensitive for competitive and contractual reasons, while any employee or user records raise the usual privacy and fraud concerns.

What data was at risk

The blackbasta listing states that internal files were exfiltrated and gives an approximate size of 650 GB. The categories named are R&D data, projects, users and employee information. Beyond those labels the exact contents remain unconfirmed. Organisations operating in telecommunications and electronics typically store engineering drawings, source code or design files, project schedules and contracts, directories of staff and contractors, and account details of customers or system users. Whether any of those specific items were among the 650 GB claimed by the group cannot be verified from the available facts. The number of individuals whose data may appear is unknown.

Why it matters

For employees and users, the presence of personal identifiers in the claimed haul creates a lasting risk of phishing, credential stuffing or identity fraud once the material is sold or published. For the company, exposure of R&D and project files can undermine competitive advantage, breach confidentiality clauses with partners, and invite regulatory scrutiny under European data-protection rules. Even if the files are never released publicly, the mere fact that an unauthorised party claims to possess them forces the organisation to investigate, notify regulators where required, and support anyone whose information may have been involved. Because the scale of personal impact is still listed as unknown, the practical burden falls on individuals to monitor their own accounts and correspondence for unusual activity.

Were you affected?

If you have ever worked for, contracted with, or supplied personal details to Amper or any of its related entities, treat the listing as a prompt to act rather than as proof that your data was taken. Concrete first steps include:

• Change passwords on any accounts that reuse credentials associated with the company, and enable multi-factor authentication wherever it is offered.
• Watch bank, credit and email accounts for unexpected messages or transactions that reference Amper or related projects.
• Request a free credit report or fraud alert if you are concerned that employee or user identifiers may have been exposed.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared elsewhere.

Public detail remains limited to the blackbasta claim of 7 June 2024. Further confirmation, if it emerges, will come from the company or from independent investigators. Until then, the safest course is to assume that any data once held by the organisation could be at risk and to take the ordinary protective measures listed above.

AICompiled with AI assistance from public sources and published under our editorial standards.