Black Basta Ransomware Strikes South African Chemical Giant Omnia in June 2024 In June 2024, South African chemical producer Omnia fell victim to a Black Basta ransomware attack, exposing sensitive employee and financial data. The breach was detected on June 10, disrupting the company’s IT systems, though critical operational infrastructure remained isolated to prevent production halts. The Black Basta ransomware group, which operates under a ransomware-as-a-service (RaaS) model, claimed responsibility and published stolen data on its dark web leak site a tactic known as "double extortion." The exfiltrated data reportedly included employee personal information, financial documents, and proprietary company records. Black Basta, active since April 2022, has targeted over 500 organizations globally, often gaining access via phishing emails or unpatched vulnerabilities before encrypting systems and stealing data. Omnia, a major player in fertilizers, chemicals, and explosives, engaged cybersecurity experts to contain the incident and reported the breach to South Africa’s Information Regulator. The company confirmed it would not pay the ransom, despite operational disruptions in non-critical systems. The attack underscores the growing cyber threats to South Africa’s critical infrastructure, with ransomware incidents affecting over half of local businesses. While Omnia’s production remained functional, prolonged IT disruptions could impact order processing, logistics, and customer deliveries, potentially causing short-term supply chain friction in regional agrochemical and industrial markets. Analysts suggest the incident may drive buyer caution, inventory stockpiling, or sourcing shifts, though broader chemical commodity prices are unlikely to see sustained volatility unless production or distribution timelines are significantly delayed.