ASVEL Basket confirms data breach

ASVEL Basket, a French basketball team headed by the former NBA star Tony Parker, said it learned about the incident from the media.

Earlier this month, ASVEL was posted on the NoEscape ransomware gang’s leak site, with attackers claiming that they exfiltrated 32GB of the team’s data, including players’ passports and IDs, ASVEL’s financial and tax data, and other confidential information.

A recently published statement from the team says the organization learned about the breach on October 12th, after media reported on the incident.

ASVEL said that while attackers exfiltrated the data, they haven’t deleted the stolen information. This is unusual behavior for ransomware gangs since they usually delete stolen data from the victim’s systems to hold it for ransom.

“The damage suffered has, to date, not led to a cessation of activity – the nature and extent of harm to third parties is being determined, with the assistance of qualified professionals and relevant state services,” ASVEL said.

The club stressed that there’s no indication that attackers accessed any payment data, such as credit card details, and the data breach did not impact the usual operations of the team.

The basketball club notified relevant law enforcement agencies about the issue and committed to raising the organization’s IT security level to prevent future hacker attacks.

ASVEL is among Europe’s most notable basketball teams, competing in the Euroleague, the continent’s strongest basketball tournament. The team’s roster includes players like Joffrey Lauvergne, Nando de Colo, David Lighty, Mike Scott, and others.

Researchers believe that NoEscape ransomware first emerged in May 2023. Like so many other ransomware cartels, it operates under the Ransomware-as-a-Service (RaaS) model: malware developers sell ransomware to operators and take a cut of their gains.

According to Ransomlooker, Cybernews’ tool for monitoring the dark web, NoEscape has hit 54 organizations since its inception. Reportedly, the gang’s ransomware demands vary from several hundreds of thousands of dollars to $10 million.

It’s believed that NoEscape is the successor to the Avaddon ransomware cartel.