Yellow Pages Canada confirmed Black Basta attack after data leak

Yellow Pages Group, the Canadian directory company behind YP.ca, YellowPages.ca and Canada411, confirmed in April 2023 that it had been the target of a cyberattack. The confirmation followed the Black Basta ransomware group posting stolen documents on its leak site over the preceding weekend.

BleepingComputer reported that dates on the leaked files indicated the intrusion took place on or after 15 March 2023. The published sample included scans of passports and driver's licences showing dates of birth and addresses, tax documents containing Social Insurance Numbers, sales and purchase agreements, an accounts receivable spreadsheet and budget and debt forecasts.

Franco Sciannamblo, the company's senior vice president and chief financial officer, said Yellow Pages had reason to believe an unauthorised third party had taken personal information from servers holding employee data, along with limited data relating to business customers.

The company said it investigated with external cybersecurity experts, contained the incident and secured its systems, and that most services had been restored. It notified the individuals it identified as affected and reported the incident to the appropriate privacy regulatory authorities.

Infosecurity Magazine noted that Yellow Pages appears to have disclosed the attack only after Black Basta made the stolen data public, a pattern security researchers quoted in that report described as increasingly common. No victim count was published, and the company did not say how long the attackers had access.