8base ransomware group claims data breach against Cyberfreight Systems Maritimes Inc.

• Ransomware group: 8base
• Country: Canada
• Sector: Transportation
• Announcement date: June 21, 2023

8base claims data theft from Cyberfreight Systems Maritimes Inc.

The 8base ransomware group has published a notice on its leak site claiming responsibility for a data breach targeting the Canadian logistics company, Cyberfreight Systems Maritimes Inc. According to the threat actor's announcement, the group has successfully exfiltrated sensitive information from the organization's internal systems.

The incident was officially listed on the group's leak site on June 25, 2023. While the announcement was made on that date, the threat actors claim that the actual data exfiltration took place earlier, specifically stating that the data was downloaded on June 18, 2023. This type of timeline is common in ransomware operations, where there is often a delay between the initial intrusion and the public announcement on a leak site.

Details of the claimed data exfiltration

The 8base group has made specific claims regarding the types of information they have allegedly obtained during their operation. The group asserts that the stolen data is extensive and includes a large database of confidential information. According to the announcement, the compromised files comprise various critical business and personal documents.

The specific categories of data mentioned in the claim include:

• Invoices
• Purchase and sale agreements
• Internal documents
• Financial documents
• Contracts
• Personal documents

The breadth of these categories suggests that the attackers aimed for a wide variety of sensitive information to increase their leverage during negotiations.

About Cyberfreight Systems Maritimes Inc.

Cyberfreight Systems Maritimes Inc. is a Canadian-based company operating within the transportation and logistics management sector. The organization provides a range of transportation solutions designed to be both reliable and economical for its clients. Through its extensive worldwide office network, the company serves a diverse client base, including both exporters and importers who require complex management of their supply chain and logistics needs.

Analysis and implications of the threat

The 8base group is recognized as a double-extortion actor, a tactic that has been prevalent since the group became active in 2022. In double-extortion schemes, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure to pay a ransom. This method is particularly effective against companies that handle high volumes of sensitive documentation.

Given that Cyberfreight Systems Maritimes Inc. operates in the logistics sector, the leaked data may pose significant risks regarding trade secrets and vital supply chain information. Such information is often critical to the competitive advantage and operational integrity of logistics firms. Furthermore, because the company is a Canadian-based entity, the breach could potentially trigger legal proceedings under regional data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA).

The inclusion of personal documents in the claim introduces secondary risks. These include the potential for identity theft or the execution of targeted phishing attacks directed at the company's employees and customers. Such attacks often leverage the stolen personal details to gain further access to systems or to defraud individuals.

While the group's infrastructure was disrupted in early 2025, their historical actions serve as a reminder of the evolving threat landscape. For organizations operating in similar sectors, these incidents underscore the necessity of reviewing and strengthening data security protocols. Implementing robust defensive measures, such as regular security audits, strict access controls, and comprehensive data encryption, remains a vital part of a modern cybersecurity posture to mitigate the risks posed by sophisticated ransomware groups.