team.jobs Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a staffing firm appears on a ransomware group's leak site, the practical concern is straightforward: personal and professional details that job seekers, contractors and employees entrusted to the company may no longer be under its sole control. For anyone who has dealt with team.jobs or its parent organisation, the listing raises immediate questions about what was taken and who might see it.

On 15 December 2023, the ransomware group known as blackbasta publicly listed team.jobs, claiming it had exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. What is known is limited to the group's own claims and basic organisational details.

Inside the incident

Public reporting states that team.jobs was listed by blackbasta on 15 December 2023. According to the information associated with that listing, the group claimed to have exfiltrated internal files during a ransomware attack and referenced a data volume of 202 GB. The listing further indicated categories labelled Kunden (customers), HR and BuHa (accounting), among others. No further technical details—such as the initial access method, the exact date of intrusion, or whether systems were encrypted—have been disclosed in the available record. The number of individuals whose information may be involved is unknown. As with other leak-site postings, the claims originate from the threat actor and have not been independently verified in the material provided.

Who is blackbasta?

Blackbasta is a ransomware operation that became widely observed in 2022. Like many contemporary groups, it has typically followed a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group has maintained a leak site on which it names organisations it claims to have compromised, a common pressure tactic. Public reporting over time has linked blackbasta to attacks across multiple sectors and countries; its operators have generally focused on organisations large enough to feel operational and reputational impact. Specific statements blackbasta may have made about team.jobs beyond the fact of the listing and the claimed data categories are not detailed in the available facts; the listing itself should be treated as an unverified claim by the group.

About team.jobs

team.jobs is associated with Das Team AG, a Swiss staffing and recruiting company based in Basel. Public descriptions indicate the firm has operated since 1987 and specialises in the placement and temporary assignment of personnel in construction and related trades, crafts, industry, technology, and medical and care roles. It is described as employing roughly 101–250 people with estimated revenue in the $25 million to $50 million range. Organisations of this type routinely handle identity documents, contact details, employment histories, payroll-related information and client company data in the course of matching workers with assignments. A breach affecting such a firm is consequential because the data often spans both job candidates and corporate clients across multiple industries, creating a wide circle of potentially affected parties.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack and reference a claimed volume of 202 GB, with named categories including Kunden (customers), HR and BuHa (accounting). Exact file contents, record counts and the full list of data fields have not been independently confirmed. Staffing and recruiting firms typically hold names, addresses, phone numbers, email addresses, dates of birth, national identification or work-permit details, CVs, bank or payment information for payroll, and contractual records with client companies. Whether any or all of those elements were present in the taken files remains unconfirmed. Readers should treat the precise composition of the data as undisclosed beyond the high-level categories claimed by the group.

The real-world impact

For individuals, exposure of staffing-related records can mean elevated risk of targeted phishing, identity misuse or fraudulent job offers that reference real personal details. HR and accounting files, if present, may contain information useful for social-engineering attacks against both workers and the company's clients. For the organisation, a public listing can disrupt operations, strain client relationships and trigger regulatory notification duties under Swiss and European data-protection rules. Because the number of affected people is unknown and the exact data types are not fully verified, the scale of downstream harm cannot be stated with precision; the concrete risk is that sensitive professional and personal information may circulate beyond the company's control.

If your data was in this claimed breach

If you have worked with team.jobs or Das Team AG as a candidate, temporary worker or client contact, treat the possibility of exposure seriously. Monitor bank and credit activity for unusual behaviour, and be cautious of unsolicited messages that reference your employment history or personal details. Change passwords on any accounts that may have shared credentials or recovery information with the firm, and enable multi-factor authentication where available. Consider placing fraud alerts with relevant credit or identity-protection services if you are in a jurisdiction that offers them. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. Keep records of any suspicious contact and report clear fraud to local authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.