secci.ca Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that sit on large volumes of client and case data, using leak-site postings to pressure victims after encryption and exfiltration. In late October 2023 one such listing named a Canadian collections and litigation specialist, adding another entry to the steady stream of claims against mid-sized organisations that handle sensitive personal and financial records.

Public reporting indicates that secci.ca was listed by the blackbasta ransomware group on 26 October 2023. The group claims internal files were taken in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. For clients, tenants, landlords and employees whose information may have been held by the firm, the listing raises concrete questions about what was exposed and what practical steps follow.

What happened

On 26 October 2023, secci.ca appeared on the leak site associated with the blackbasta ransomware group. According to the available summary, the incident involved the exfiltration of internal files in a ransomware attack. No public figure has been given for the volume of data, the number of individuals affected, or the precise date the intrusion began. Method of initial access, duration of presence inside the network, and whether encryption was also deployed have not been disclosed in the material provided. The listing itself constitutes a claim by the group rather than an independently verified forensic report.

Suite Excel Collections Canada Inc., operating as SECCI or secci.ca, has not had further technical details released in the sources used for this account. As with many ransomware claims, the public record at the time of reporting is limited to the group’s assertion that internal files were taken.

The group behind it: blackbasta

Blackbasta is a ransomware operation that emerged in public reporting in 2022 and has since been linked to numerous attacks on organisations across multiple sectors and countries. The group typically follows a double-extortion model: data is stolen before systems are encrypted, and victims are threatened with publication if a ransom is not paid. Listings on its leak site are the usual means of applying that pressure and of advertising successful intrusions to other potential targets.

Publicly documented tactics associated with blackbasta include phishing, exploitation of exposed remote-access services, and the use of common post-exploitation tools to move laterally and stage data for exfiltration. The group has previously claimed responsibility for attacks on manufacturing, logistics, professional services and other mid-market entities. None of those general patterns, however, should be read as confirmed specifics of the secci.ca incident; they describe the actor’s established reputation rather than forensic findings unique to this case. In the present matter, blackbasta’s sole public assertion is that secci.ca’s internal files were exfiltrated.

Who is secci.ca?

Suite Excel Collections Canada Inc. (SECCI) describes itself as a specialist in landlord-tenant litigation and collection recovery for property-management firms, real-estate investment trusts and landlords across Canada. The firm states that it oversees a large collection and litigation portfolio, employing licensed collectors, paralegals and legal clerks who provide services in all provinces and territories. It cites roughly twenty-five years of experience and the use of advanced file-management technology.

Organisations of this type routinely handle tenant contact details, lease and payment histories, court filings, correspondence with counsel, and financial records tied to arrears and judgments. Because the work spans multiple jurisdictions and involves both commercial clients and individual tenants, a compromise can touch a wide circle of people who never dealt directly with the firm but whose data appears in case files. That concentration of personal, financial and legal information is why a ransomware claim against such a provider carries weight beyond the organisation’s own operations.

What was likely exposed

The only data type named in the available facts is “internal files” said to have been exfiltrated in the ransomware attack. No inventory of file categories, no record counts, and no confirmation of specific personal-data fields have been published. Exact contents therefore remain unconfirmed.

In the ordinary course of business, a collections and landlord-tenant litigation firm would be expected to hold names, addresses, telephone numbers, email addresses, tenancy and payment records, correspondence, court documents, and possibly banking or identification details supplied for enforcement purposes. Employees’ personnel and payroll information could also reside on internal systems. None of these categories can be asserted as factually present in the stolen set; they represent the typical holdings of the sector and the reason the claim is material. Until a detailed disclosure or regulatory notice appears, the precise exposure stays unknown.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include unwanted contact, attempts at social engineering that reference real tenancy or debt details, and the long-term possibility that personal data will be traded or reused in further fraud. Even limited internal documents can supply enough context for convincing phishing or identity-related misuse. Tenants and landlords alike may face residual uncertainty until they know whether their own records were involved.

For the organisation, the stakes include operational disruption, potential regulatory scrutiny under Canadian privacy law, contractual obligations to clients, and reputational damage that can affect future retainers. Because the firm positions itself as a trusted handler of large litigation and collection portfolios, any confirmed loss of control over client files carries direct business consequences. The absence of public figures on scale does not reduce those risks; it simply leaves both the company and potentially affected parties working with incomplete information.

Were you affected?

If you have been a client, tenant, landlord or employee connected to SECCI’s collections or litigation work, treat the claim as a prompt to review your own exposure rather than as proof that your data was taken. Monitor financial and credit statements for unfamiliar activity, be cautious of unsolicited messages that cite tenancy or debt details, and consider placing fraud alerts where appropriate. Retain any official notices the firm or regulators may issue.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding whether your information is circulating more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.