Employ Milwaukee listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: United States
• Sector: Government & Defense
• Announcement date: December 20, 2023

8base claims data breach at Employ Milwaukee

The threat actor known as 8base has listed Employ Milwaukee on its leak site, alleging a data breach. According to the announcement made on December 20, 2023, the group claims to have obtained data related to the organization's workforce development operations. This claim marks a new addition to the group's list of targets, as they assert they have successfully exfiltrated sensitive information from the entity.

8base is recognized as a double-extortion group that has been active since 2022. In a double-extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the stolen data on a public leak site, the attackers attempt to pressure the victim into paying a ransom to prevent the exposure of confidential files.

Details of the alleged data theft

The announcement provided by the threat actor specifies a variety of compromised documents and files. While the specific volume of data and the exact number of files have not been disclosed, the group claims that the breach involves a broad spectrum of administrative and personal documentation. The listed items suggest that the breach touches upon both financial and human resources aspects of the organization.

The following types of data are reportedly included in the leak:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements

The presence of such diverse documentation types indicates that the attackers may have gained access to internal administrative systems used for managing both business finances and personnel records.

About Employ Milwaukee

Employ Milwaukee is a public organization serving as the workforce development board for Milwaukee County. The organization plays a critical role in the regional economy by aiming to connect job seekers with employment opportunities. Furthermore, it focuses on providing education and training options and assists in developing a skilled workforce to support businesses in the region.

Potential impact and security considerations

The alleged breach may expose employees and service recipients to significant risks, such as identity theft, due to the nature of the compromised personal data and employment-related documents. Given the organization's role in public workforce development, the compromised data could potentially be leveraged for supply chain attacks or targeted phishing campaigns against the individuals involved or their business partners.

As a United States-based entity, the organization may face regulatory scrutiny under relevant state laws and federal data protection standards following such an incident. Furthermore, considering 8base's history of using Phobos-variant encryptors, it is possible that the organization's operational continuity has been impacted by the underlying attack. While information about this specific group remains limited in the public domain, the incident highlights the ongoing risks faced by public sector organizations.

For organizations operating within the government and public service sectors, maintaining robust security postures is essential. This includes implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of phishing. Additionally, monitoring for unauthorized data exfiltration and ensuring strict access controls on sensitive administrative and personal files can help reduce the potential impact of a breach.