jlgmarine.com Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 28 October 2023, the website jlgmarine.com, operated by John Lilley & Gillie Ltd, was listed by the ransomware group known as blackbasta. Public reporting indicates the group claims to have exfiltrated internal files in a ransomware attack, with a stated data volume of 97 GB. The number of people affected remains unknown, and independent confirmation of the full scope has not been published.

The listing matters because the company supplies specialised marine instruments used worldwide. Any exposure of internal business material can create lasting operational, commercial and personal risks even when exact victim counts are undisclosed.

Inside the incident

According to the information released with the listing, blackbasta claimed responsibility for a ransomware attack against John Lilley & Gillie Ltd that involved the theft of internal files. The group stated the full data size as 97 GB and described categories that included finance, confidentiality, research and development, and users data. Additional material accompanying the claim referenced network identifiers and domain-administrator accounts associated with the organisation’s environment. No public technical timeline, initial access method, or independent verification of the exfiltration has been supplied. The number of individuals whose information may be involved is recorded as unknown.

Who is blackbasta?

Blackbasta is a ransomware operation that emerged in public reporting in 2022. The group typically gains access to corporate networks, steals data, encrypts systems, and then posts victim names on a dedicated leak site to pressure payment. It has been linked to attacks across manufacturing, professional services and other sectors. Like other ransomware crews, blackbasta’s leak-site entries constitute claims by the actors themselves; they are not automatically confirmed by the named organisations or by independent investigators. In this case the listing of jlgmarine.com should be treated as an unverified claim pending further corroboration.

Who is jlgmarine.com?

John Lilley & Gillie Ltd, trading via jlgmarine.com, is a long-established British manufacturer of magnetic compasses and nautical instruments. Public descriptions note more than two centuries of continuous expertise serving the marine industry worldwide. Its registered address is given as 8 Neptune Court, Orion Business Park, NE29 7UW, North Shields, England. Organisations of this type routinely hold design drawings, supplier and customer records, financial data, employee information and research material. A breach affecting such a firm can disrupt supply chains, expose proprietary technical knowledge and place personal data of staff or business contacts at risk.

The information in question

The only data types explicitly named in the available reporting are “internal files exfiltrated in [a] ransomware attack,” with the accompanying claim listing finance, confidentiality, research and development, and users data, together with a stated volume of 97 GB. No further inventory of specific documents, databases or individual records has been published by independent sources. Companies in the marine-instrument sector commonly retain financial ledgers, contracts, employee and user accounts, technical drawings and research files; whether any particular subset of those materials was taken remains unconfirmed beyond the group’s own assertions.

What's at stake

For individuals whose details may appear in the claimed data set, the practical risks include targeted phishing, identity misuse or unsolicited contact that leverages accurate internal knowledge. For the company, exposure of financial or research material can weaken commercial negotiating positions, reveal proprietary designs, and require costly remediation and notification work. Because the precise contents and the number of affected people are still unknown, the full scale of harm cannot yet be measured. Even limited internal files can be sufficient for follow-on social-engineering attacks against staff, customers or suppliers.

Were you affected?

If you have done business with, worked for, or otherwise shared personal information with John Lilley & Gillie Ltd, treat the possibility of exposure seriously until more definitive information appears. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be cautious of unexpected messages that reference the company or its products. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official updates, if any are issued by the organisation or by regulators, should be regarded as the authoritative source for next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.