8base claims data breach at Compagnie regionale d'aliments (COREAL)

• Ransomware group: 8base
• Country: France
• Sector: Agriculture and Food Production
• Announcement date: May 23, 2023

8base claims data exfiltration from COREAL

The threat actor known as 8base has listed the French-based company COMPAGNIE REGIONALE D'ALIMENTS (COREAL) on its leak site. The group claims to have exfiltrated data belonging to the organization, marking a significant targeted incident against the French agriculture and food production sector.

According to the announcement published on the group's leak site, the incident is claimed to have occurred on January 23, 2023. The post made by the threat actor includes specific details regarding the company's operations and contact information. Furthermore, the group provided a link intended for downloading the alleged stolen data.

Details of the claimed data leak

While the threat actor has provided a file download link, the specific nature and exact scope of the leaked information remain undisclosed. The group has not provided information regarding the total volume of data stolen or the specific number of files involved in the breach. The listing names no specific data types.

In many ransomware incidents, the exact contents of a breach are only known after the data is analyzed by security researchers or the victims themselves. The lack of specific details in the initial leak site announcement is a common occurrence in cyberattacks, where groups may withhold specific file types to maintain leverage during negotiations or simply due to the chaotic nature of the exfiltration process.

About Compagnie regionale d'aliments (COREAL)

COMPAGNIE REGIONALE D'ALIMENTS (COREAL) is a French organization operating within the agriculture and food production sector. Operating since 1947, this family business specializes in the production of animal feed for poultry, pigs, and ruminants. The company is committed to an independent and innovative approach and serves farmers as part of the Group Michel.

Analysis and potential organizational impact

The 8base group is recognized for utilizing double-extortion tactics. This method typically involves both the encryption of an organization's systems and the exfiltration of sensitive data. By stealing data before encryption, the attackers create a secondary layer of pressure, threatening to release the information publicly if a ransom is not paid, even if the victim can restore their systems from backups.

The exposure of sensitive information can lead to various secondary risks. If employee or customer data were included in the breach, it could lead to identity theft or targeted phishing campaigns against the affected individuals. Given that the company is located in France, this incident may trigger data breach notification requirements under the General Data Protection Regulation (GDPR).

The severity of such an incident can lead to significant reputational damage and legal consequences, depending on the sensitivity of the information that was exposed. It is also worth noting that the group's infrastructure was disrupted in early 2025, which suggests that their operational capabilities may have evolved over time.

For organizations in the food production and agriculture sectors, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent phishing. Furthermore, organizations must ensure compliance with regional data protection laws to mitigate the legal impact of potential breaches.