8base ransomware group lists SOFPO (Exideuil) on its leak site

• Ransomware group: 8base
• Country: France
• Sector: Manufacturing
• Announcement date: October 9, 2024

8base claims a data breach against SOFPO

The 8base ransomware group has published an announcement on its leak site claiming to have obtained data belonging to the France-based organization SOFPO (Exideuil). According to the group's claim, the incident occurred on September 23, 2024, and the announcement was made on October 9, 2024. This type of activity is characteristic of a double-extortion ransomware attack, a method where threat actors not only encrypt an organization's systems but also exfiltrate sensitive data to use as leverage for ransom demands.

In a double-extortion scheme, the attackers threaten to release stolen information on public leak sites if the victim refuses to pay. This tactic significantly increases the pressure on an organization, as the threat moves from mere operational disruption to the potential exposure of sensitive corporate and personal information. While the group has listed various files on its site, no specific information was provided regarding the total size of the data or the specific number of files stolen.

Details of the claimed data theft

The 8base group has listed several categories of files that they claim were obtained from the organization's systems. The leaked information appears to encompass a wide range of administrative, financial, and personal documentation. The group's announcement indicates that the following types of data are involved in the leak:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements

The exposure of such diverse documentation suggests a significant breach of internal administrative processes. When sensitive documents like employment contracts and confidentiality agreements are compromised, the impact often extends beyond the immediate corporate infrastructure to include the private lives of the individuals involved.

About SOFPO

SOFPO is a French company specializing in the design, production, and conversion of corrugated cardboard packaging. The company provides industrial packaging solutions, serving as a key player in the manufacturing sector through its specialized production capabilities.

Analysis and potential impact

The 8base group is a known threat actor that has been active since 2022. They are recognized for utilizing encryptors derived from the Phobos ransomware family. Although operations were conducted against the group's infrastructure in early 2025, this recent announcement suggests that the consequences of their past activities may continue to manifest through ongoing leaks.

The leakage of this data poses several secondary risks. For employees and business partners, the exposure of personal data, certificates, and employment contracts can lead to identity theft or the execution of highly targeted phishing attacks. Furthermore, for a company based in France, such an incident may lead to legal and administrative sanctions under the European Union's General Data Protection Regulation (GDPR) due to the potential exposure of personal information.

From a business perspective, the disclosure of trade secrets and confidential agreements could potentially create negative impacts on the company's competitive advantage. In the manufacturing sector, maintaining the confidentiality of proprietary processes and agreements is vital for market positioning.

To mitigate such risks, organizations in the manufacturing sector often implement defensive measures such as robust data encryption, strict access controls, and comprehensive employee training to recognize phishing attempts. Regular audits of data access and the implementation of multi-factor authentication are also common industry practices to protect against the exfiltration methods used by groups like 8base.