haes.ca Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 13 December 2023, the Canadian energy-services firm operating as haes.ca appeared on a ransomware leak site operated by the group known as blackbasta. The listing asserts that internal files were taken in a ransomware attack and that roughly 345 GB of material was involved. The number of people whose information may sit inside those files remains unknown. For employees, contractors, partners and anyone whose details appear in human-resources, finance or project records, the practical question is straightforward: whether personal or commercial data has left the organisation’s control and what that exposure could mean in ordinary life.

Public detail is limited to the group’s claim and a short description of the company. No independent confirmation of the intrusion method, the exact timeline, or a full inventory of the files has been released. What follows sets out only what has been stated, places it in the context of how blackbasta typically works, and outlines the concrete risks and steps available to anyone who may be affected.

Inside the incident

According to the leak-site entry dated 13 December 2023, blackbasta listed haes.ca and claimed to have exfiltrated internal files during a ransomware attack. The group stated the total volume of data as 345 GB and listed broad categories: Human Resources, Finance, Executive and Governance, Administration, and Projects. No further breakdown of file names, record counts or specific documents has been published in the available material. The number of individuals whose data may be included is recorded as unknown.

The method of initial access, the duration of any presence inside the network, and whether systems were encrypted in addition to data theft are all undisclosed. There is likewise no public statement from the company confirming or disputing the claim. In short, the incident is known chiefly through the group’s own listing; independent verification of scale, content and impact has not been supplied in the facts at hand.

The group behind it: blackbasta

Blackbasta is a ransomware operation that emerged in public reporting in 2022 and has since been linked to numerous attacks on organisations across multiple sectors. Like many contemporary ransomware groups, it commonly follows a double-extortion model: data are copied out of the victim environment before encryption is deployed, and the threat of public release is used to pressure payment. Victims are frequently named on a dedicated leak site, sometimes accompanied by sample files or volume claims, if negotiations stall or no payment is made.

The group has been observed targeting a range of industries, including manufacturing, professional services and energy-related firms. Public technical analyses describe the use of common initial-access routes such as compromised credentials, phishing or exploitation of exposed remote-access services, followed by lateral movement and data staging. None of these general patterns should be read as Reported Details of the haes.ca incident; they simply describe how blackbasta has operated in other documented cases. In the present matter, the sole specific assertion is the leak-site listing itself, which remains an unverified claim by the group.

haes.ca and its sector

haes.ca is the online presence of High Arctic Energy Services, an energy-services provider headquartered in Calgary, Alberta. Public descriptions state that the company is a market leader in Papua New Guinea for drilling and specialised well-completion services and that it supplies rental equipment including rig matting, camps, material-handling and drilling-support gear. In western Canada it provides pressure-control equipment on a rental basis to exploration and production companies. Its listed address is 330 5th Ave SW, Suite 2350, Calgary, Alberta, T2P 0L4, Canada.

Firms in this sector routinely hold operational, commercial and personnel information necessary to run drilling programmes, manage equipment fleets, administer contracts and employ staff across jurisdictions. A breach affecting such an organisation therefore carries consequences beyond a single office: it can touch employees and contractors in Canada and overseas, counterparties in the oil-and-gas supply chain, and the commercial confidentiality of projects. Because the company operates in both domestic and international energy markets, any exposure of internal files can affect multiple regulatory and contractual environments at once.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack,” with the group claiming a total size of 345 GB and listing the categories Human Resources, Finance, Executive and Governance, Administration, and Projects. No more granular inventory—such as specific document types, whether payroll files, identity documents, bank details or contracts were present—has been disclosed. The exact contents therefore remain unconfirmed.

Organisations of this kind typically maintain personnel records (names, contact details, employment contracts, payroll and benefits data), financial ledgers and invoices, board and governance papers, administrative correspondence, and project files that may include technical specifications, client information and commercial terms. It is reasonable to expect that some mixture of these materials could fall inside the claimed categories, yet it is not established fact that any particular data element was taken. Readers should treat the listed headings as the group’s description, not as a verified catalogue.

What's at stake

For individuals, the principal risks are misuse of personal information that may appear in human-resources or administrative files—identity fraud, targeted phishing, or unsolicited contact that leverages knowledge of employment or location. Finance-related records could expose banking or payment details belonging to staff or suppliers. Project and executive materials, if released, may reveal commercially sensitive arrangements that competitors or other parties could exploit, potentially harming the company’s negotiating position or client relationships.

For the organisation itself, the stakes include operational disruption, possible regulatory notification duties in Canada and elsewhere, contractual obligations to clients and partners, and the longer-term cost of investigating and remediating the incident. Because the number of people affected is unknown and the precise data set is unconfirmed, the full scope of these risks cannot yet be quantified. The absence of public confirmation also leaves affected parties without an official channel for tailored advice from the company at the time of writing.

If your data was in this claimed breach

If you have worked for, contracted with, or otherwise supplied personal or commercial information to High Arctic Energy Services, treat the possibility of exposure seriously until more is known. Monitor financial accounts and credit reports for unfamiliar activity. Be cautious of unexpected emails, calls or messages that reference your employment, projects or personal details; verify any such contact through independent channels. Change passwords on work-related and personal accounts that may have been reused, and enable multi-factor authentication where it is available. If you are an employee or contractor, ask the company’s human-resources or security team whether they have issued guidance or are offering support such as credit monitoring.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can indicate whether your details are circulating more widely and help you prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.