Calgary TELUS Convention Centre listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Canada
• Sector: Hospitality
• Announcement date: December 6, 2023

8base claims data breach at Calgary TELUS Convention Centre

The 8base ransomware group has officially listed the Calgary TELUS Convention Centre on its dedicated leak site. According to the announcement made on December 6, 2023, the threat actor group claims to have successfully obtained data belonging to the organization. This development follows the group's established pattern of claiming responsibility for breaches to exert pressure on their targets.

The incident was announced on the same day the group claims the attack occurred, which was December 6, 2023. While the group has publicized the organization's name on their platform, they have not provided specific details regarding the total size of the data stolen or the exact number of files involved. Furthermore, no specific ransom demand has been disclosed in the public announcement.

Details of the claimed attack

The 8base group asserts that they have gained unauthorized access to the institution's internal systems, specifically targeting sensitive information. The group claims to have accessed various financial and operational documents belonging to the Calgary TELUS Convention Centre. This breach suggests that critical information regarding the organization's event management and its various operational processes may be at risk of exposure.

Ransomware groups often utilize a method known as double extortion. In this tactic, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat of leaking this stolen information on a public website serves as a secondary layer of pressure, intended to coerce the victim into paying a ransom to prevent the public release of their private data.

Alleged contents of the leaked data

According to the claims made by the 8base group, the stolen information is extensive and covers various aspects of the organization's business and personnel management. The group alleges that the leak includes a wide variety of sensitive files that could impact both the company and its stakeholders. The items identified in the claim include:

• Financial documents
• Personal data
• Employment contracts
• Confidentiality agreements
• Invoices
• Receipts
• Accounting documents
• Certificates
• Other personal files

The inclusion of such diverse data types—ranging from financial records to individual employment contracts—highlights the potential breadth of the breach and the sensitive nature of the information the group claims to possess.

Risk assessment and organizational implications

This incident poses significant secondary risks to the organization, its employees, and its customers. The exposure of personal data and employment contracts can lead to identity theft and makes individuals targets for highly specific, targeted phishing attacks. Such attacks often leverage the stolen information to appear legitimate, increasing the likelihood of success against unsuspecting employees or clients.

Because the organization operates within Canada, this incident may trigger specific legal obligations. Depending on the exact nature and sensitivity of the leaked data, the organization may be required to comply with regulatory requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA). Organizations facing such breaches typically must initiate formal data breach notification procedures to inform the affected parties and relevant authorities.

It is worth noting that while the 8base group's infrastructure faced disruption in early 2025, the group has demonstrated a tendency to continue employing similar tactics, potentially using ransomware derivatives such as Phobos. This highlights the evolving nature of ransomware threats where groups continue to adapt their methods even after infrastructure setbacks. For organizations in the hospitality and event management sector, maintaining robust data protection measures and having a clear incident response plan is essential to mitigate the impact of such sophisticated extortion attempts.