MORSEMOVING Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations of every size by pairing system encryption with the theft and threatened release of internal data. Listings on criminal leak sites have become a routine feature of this landscape, often appearing before independent confirmation of what was taken or how many people were affected. Against that backdrop, the appearance of a long-established moving company on such a site in mid-2023 fits a familiar pattern of claims that demand careful, limited reporting.

On 20 June 2023, MORSEMOVING was listed by the ransomware group known as blackbasta. Public detail is limited: the number of people affected remains unknown, and the only data description available is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group rather than a verified disclosure. For customers, employees and partners of a relocation business, even an unconfirmed claim raises practical questions about what may have been exposed and what steps are worth taking.

What happened

According to the available record, MORSEMOVING was listed by the blackbasta ransomware group on 20 June 2023. The report states that internal files were exfiltrated in a ransomware attack. No further technical detail has been made public about the initial access method, the duration of any intrusion, whether systems were encrypted, or whether a ransom demand was issued or paid. The number of people affected is recorded as unknown. Beyond the group’s leak-site listing and the characterisation of the incident as involving exfiltrated internal files, specifics remain undisclosed.

The group behind it: blackbasta

Blackbasta is a ransomware operation that became widely documented in 2022. Like other groups using a double-extortion model, it is known for encrypting victim systems while also copying data and threatening to publish it if payment is not made. The group has historically targeted organisations across multiple sectors and geographies, often advertising victims on a dedicated leak site to increase pressure. Public reporting has associated blackbasta with relatively polished negotiation tactics and with the use of common initial-access routes such as compromised credentials or exploited vulnerabilities, though the precise vector in any single case is frequently unconfirmed.

In this instance, the only direct assertion tied to MORSEMOVING is the group’s own listing of the organisation and the statement that internal files were exfiltrated. No additional claims by blackbasta about this specific victim—such as sample file dumps, employee counts, or financial figures—are part of the public record provided here. The listing should therefore be treated as an unverified claim pending any independent confirmation.

MORSEMOVING and its sector

MORSEMOVING is a family-founded relocation and moving company. Public background supplied with the incident record notes that Herb and Vi Morse established the business in 1954; successive generations have remained involved in packing, loading, driving and operations. The company describes itself as providing residential and related moving services and emphasises training of drivers and service providers. Moving and storage firms typically handle customer contact details, inventory lists, billing information, insurance documentation, employee records and operational schedules. They may also hold temporary access to customers’ physical addresses and, in some cases, sensitive household or commercial inventory data.

A breach claim against such an organisation is consequential because the sector sits at the intersection of personal and commercial logistics. Customers entrust movers with knowledge of when homes will be empty, what is being transported, and how to reach them. Employees and contractors supply identity and payroll information. Even when the precise scope of an incident is unknown, the nature of the business means that internal files can contain material relevant to both private individuals and the firm’s own continuity.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of file types, no count of records, and no confirmation of customer, employee or financial data have been publicly detailed in the material available. Organisations in the moving sector commonly hold names, addresses, phone numbers, email addresses, job sheets, invoices, insurance forms and personnel files. It is reasonable to note that such categories are typical; it is not established that any specific category was present in the files the group claims to have taken. Exact contents remain unconfirmed.

The real-world impact

For individuals, the practical risks of internal-file exposure at a moving company centre on unwanted contact, targeted phishing that references a real move or address, and possible misuse of identity or billing details if those were present. Because the number of people affected is unknown and the file contents are not itemised, it is not possible to state who, if anyone, has already experienced harm. For the organisation, a public ransomware listing can disrupt operations, strain customer trust and create legal or notification obligations depending on jurisdiction and on what is later verified. Recovery from encryption, if it occurred, and the cost of investigation are common consequences in similar cases, though neither is confirmed here.

The absence of confirmed scale does not eliminate concern; it simply means responses should be proportionate and based on verification rather than assumption. Customers who recently used the company, and current or former staff, have the clearest reason to monitor for unusual activity.

What to do if you're exposed

If you have a past or present relationship with MORSEMOVING, treat the incident as a prompt to review your own exposure rather than as proof that your data was taken. Change passwords on accounts that may have shared credentials or recovery emails with the company, and enable multi-factor authentication where it is available. Watch bank and credit statements for unfamiliar charges and consider a fraud alert if you believe identity data could have been involved. Be sceptical of unexpected messages that reference a move, a refund or a delivery problem; verify any such contact through official channels you already trust. Keep copies of important documents and note dates of any suspicious activity.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can show whether your address is circulating more widely and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.