Omnia: South African Industrial Giant Omnia Hit by Black Basta Ransomware

Black Basta Ransomware Strikes South African Chemical Giant Omnia in June 2024

In June 2024, South African chemical producer Omnia fell victim to a Black Basta ransomware attack, exposing sensitive employee and financial data. The breach was detected on June 10, disrupting the company’s IT systems, though critical operational infrastructure remained isolated to prevent production halts.

The Black Basta ransomware group, which operates under a ransomware-as-a-service (RaaS) model, claimed responsibility and published stolen data on its dark web leak site a tactic known as "double extortion." The exfiltrated data reportedly included employee personal information, financial documents, and proprietary company records. Black Basta, active since April 2022, has targeted over 500 organizations globally, often gaining access via phishing emails or unpatched vulnerabilities before encrypting systems and stealing data.

Omnia, a major player in fertilizers, chemicals, and explosives, engaged cybersecurity experts to contain the incident and reported the breach to South Africa’s Information Regulator. The company confirmed it would not pay the ransom, despite operational disruptions in non-critical systems.

The attack underscores the growing cyber threats to South Africa’s critical infrastructure, with ransomware incidents affecting over half of local businesses. While Omnia’s production remained functional, prolonged IT disruptions could impact order processing, logistics, and customer deliveries, potentially causing short-term supply chain friction in regional agrochemical and industrial markets. Analysts suggest the incident may drive buyer caution, inventory stockpiling, or sourcing shifts, though broader chemical commodity prices are unlikely to see sustained volatility unless production or distribution timelines are significantly delayed.

Source: https://www.chemanalyst.com/NewsAndDeals/NewsDetails/south-african-industrial-giant-omnia-hit-by-black-basta-43409

Omnia Group - Consulenza Informatica & Sviluppo Software cybersecurity rating report: https://www.rankiteo.com/company/omnia-group

"id": "OMN1784557564",
"linkid": "omnia-group",
"type": "Ransomware",
"date": "6/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Chemicals, Fertilizers, Explosives',
                        'location': 'South Africa',
                        'name': 'Omnia',
                        'type': 'Corporation'}],
 'attack_vector': ['Phishing emails', 'Unpatched vulnerabilities'],
 'data_breach': {'data_encryption': 'Yes (ransomware encryption)',
                 'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Employee personal information',
                                              'Financial documents',
                                              'Proprietary company records']},
 'date_detected': '2024-06-10',
 'description': 'In June 2024, South African chemical producer Omnia fell '
                'victim to a Black Basta ransomware attack, exposing sensitive '
                'employee and financial data. The breach disrupted the '
                'company’s IT systems, though critical operational '
                'infrastructure remained isolated to prevent production halts. '
                'The Black Basta ransomware group claimed responsibility and '
                'published stolen data on its dark web leak site as part of a '
                'double extortion tactic.',
 'impact': {'brand_reputation_impact': 'Potential buyer caution, inventory '
                                       'stockpiling, or sourcing shifts',
            'data_compromised': 'Employee personal information, financial '
                                'documents, proprietary company records',
            'identity_theft_risk': 'High (employee personal information '
                                   'exposed)',
            'operational_impact': 'Disruptions in order processing, logistics, '
                                  'and customer deliveries; potential '
                                  'short-term supply chain friction',
            'systems_affected': 'IT systems (non-critical)'},
 'motivation': 'Financial gain (ransom), Data exfiltration for extortion',
 'ransomware': {'data_encryption': 'Yes',
                'data_exfiltration': 'Yes',
                'ransom_paid': 'No',
                'ransomware_strain': 'Black Basta'},
 'references': [{'source': 'Cyber incident report'}],
 'regulatory_compliance': {'regulatory_notifications': 'Reported to South '
                                                       'Africa’s Information '
                                                       'Regulator'},
 'response': {'containment_measures': 'Isolated critical operational '
                                      'infrastructure to prevent production '
                                      'halts',
              'incident_response_plan_activated': 'Yes',
              'law_enforcement_notified': 'Reported to South Africa’s '
                                          'Information Regulator',
              'third_party_assistance': 'Cybersecurity experts'},
 'threat_actor': 'Black Basta ransomware group',
 'title': 'Black Basta Ransomware Strikes South African Chemical Giant Omnia',
 'type': 'Ransomware'}