ANS listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: United Kingdom
• Sector: Technology
• Announcement date: August 15, 2023

8base claims to have compromised ANS data

The technology company ANS has been listed on the leak site of the 8base ransomware group. The 8base group claims to have compromised data belonging to ANS and has published it on their leak site. The announcement was created on August 22, 2023, referencing the company's operations in the technology sector. The group is employing a double-extortion tactic by threatening to release the institution's data.

Double-extortion is a common ransomware tactic where threat actors do not merely encrypt an organization's files to disrupt operations, but also steal sensitive information beforehand. The attackers then threaten to leak this stolen data on public forums or leak sites if the ransom is not paid. This method increases the pressure on the victim, as the threat of data exposure can lead to significant reputational damage and regulatory scrutiny, even if the organization has robust backup systems to recover from the initial encryption.

Alleged data types involved in the leak

According to the screenshot provided by the attackers, the allegedly leaked data includes a wide variety of sensitive information. The group claims to have access to various internal and personal documents, which may include:

• Invoices
• Receipts
• Accounting documents
• Certificates
• Employment contracts
• Confidentiality agreements
• Personal files of employees
• Personal files of clients
• Personal documentation
• Correspondence
• Data about partners
• Internal documents

The breadth of the data types mentioned suggests a significant breach of administrative and operational information. When such a wide array of documents is involved, it often indicates that the attackers have gained access to file servers or cloud storage environments where organizational business processes are documented.

About ANS

ANS is a UK-based technology company providing cloud computing, digital transformation, and managed IT services. The company specializes in delivering end-to-end technology solutions and professional apprenticeship training programs for the public sector and enterprise businesses.

Potential risks and impact assessment

This alleged leak may pose secondary risks such as identity theft and targeted phishing attacks for the company's employees and clients. Because the leaked information includes personal files and employment contracts, individuals associated with the company may be at higher risk of social engineering attempts. Furthermore, as a UK-based entity, confirmation of the breach could lead to legal sanctions and investigations by data protection authorities under the UK GDPR. The double-extortion tactic used by the 8base group may result in significant reputational damage and the disclosure of trade secrets through the publication of data.

It is worth noting that while it is known that the 8base group has used Phobos-derived encryptors in the past, information about this group remains limited. Such leaks may also negatively impact the organization's supply chain, as the company provides services to the public sector and enterprise businesses. A compromise in a technology service provider can create a ripple effect, potentially exposing the data or systems of their clients.

For organizations operating in the technology and managed services sector, maintaining high standards of cybersecurity is critical to protecting the supply chain. Common defensive steps include implementing strict access controls, utilizing multi-factor authentication, and maintaining continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, ensuring compliance with regional data protection regulations is essential to mitigate the legal and financial consequences that follow a confirmed data breach.