Clarke Centre d'Imagerie Médicale Inc. listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Canada
• Sector: Healthcare
• Announcement date: December 21, 2024

A data breach claim against Clarke Centre d'Imagerie Médicale Inc.

The 8base ransomware group has officially listed the Canadian healthcare provider CLARKE CENTRE D'IMAGERIE MEDICALE INC. on its leak site. According to the announcement made on December 21, 2024, the threat actor group claims to have successfully exfiltrated sensitive data belonging to the organization. This listing follows an alleged incident that took place at the beginning of December 2024.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. In many cases, these groups employ a tactic known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public forum is used as leverage to coerce the victim into paying a ransom. If the ransom is not met, the group threatens to publish the information, which can lead to severe reputational damage and legal complications.

Details of the alleged exfiltration

The 8base group alleges that the data was extracted directly from the organization's servers. While the specific volume of data and the exact number of files involved have not been disclosed by the group, the announcement specifies several categories of compromised information. The group has threatened to publish this data as a direct consequence of the incident.

The types of data claimed to be compromised include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Various personal files

The presence of such diverse documentation suggests a broad compromise of both administrative and personal information within the organization's digital environment.

About Clarke Centre d'Imagerie Médicale Inc.

Clarke Centre d'Imagerie Médicale is a medical imaging center located in Montreal, Canada. The facility provides a range of radiology and imaging services to patients. The organization's service model is characterized by a focus on providing a personalized and comfortable approach to patient care through its specialized imaging services.

Risks and implications of the incident

The alleged compromise of personal and financial information carries significant risks. For the employees and patients of the organization, the exposure of such data may increase the likelihood of identity theft or various forms of fraud. Furthermore, because the organization operates within the healthcare sector in Canada, this incident may lead to legal consequences under data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA).

The 8base group is recognized as a double-extortion actor that has been known to utilize Phobos-variant encryptors. It is worth noting that while the group's infrastructure faced disruption in early 2025, cybercriminal actors of this nature often continue their operations by adopting different names or utilizing new methods to evade detection.

The potential publication of the organization's data could facilitate targeted phishing attacks against the affected individuals or create vulnerabilities within the supply chain. To mitigate such risks, organizations in the healthcare sector typically focus on robust defensive measures. These include implementing strong access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized data exfiltration. Protecting sensitive patient and employee information remains a critical priority for healthcare providers to maintain trust and comply with regulatory standards.