Filexis AG Treuhand und Immobilien listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Switzerland
• Sector: Professional Services
• Announcement date: March 20, 2024

The 8base ransomware group claims a breach of Filexis AG Treuhand und Immobilien

The 8base ransomware group has listed the Swiss-based organization Filexis AG Treuhand und Immobilien on its dedicated leak site. Through this announcement, the threat actor group claims to have successfully exfiltrated sensitive data from the institution's servers. The listing, which was initiated in March 2024, serves as a public notification of the alleged breach, a common tactic used by ransomware groups to pressure victims.

This incident follows a pattern of behavior observed in modern cybercrime, where threat actors move beyond simple encryption to focus on data theft. By publishing the names of targeted organizations on public leak sites, these groups aim to maximize the visibility of their successful operations. In this specific case, the group has signaled that they have obtained a variety of documents belonging to the firm, marking a significant escalation in the threat landscape facing the organization.

Details of the alleged data exfiltration

According to the claims made by the 8base group, the stolen information is quite extensive and covers a wide range of sensitive business and personal documentation. The group asserts that the data was obtained directly from the organization's internal systems. While the specific volume of the data and the exact file counts have not been disclosed by the attackers, the nature of the files mentioned suggests a high level of sensitivity regarding the firm's operations and its client base.

The types of information reportedly included in the leak are as follows:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Various personal files

The presence of such diverse documentation—ranging from financial records like invoices and receipts to legal documents like employment contracts and confidentiality agreements—indicates a deep penetration into the organization's file servers. This variety of data types is typical of modern ransomware campaigns that target professional service providers to gain access to high-value information.

About Filexis AG Treuhand und Immobilien

Filexis AG is an independent firm based in Fislisbach, Switzerland. The organization provides a specialized suite of services, including real estate management, sales, and fiduciary services. The company is structured to offer professional support tailored to the specific needs of private individuals as well as small to medium-sized enterprises (SMEs).

As a firm operating within the professional services sector, the organization handles significant amounts of sensitive client information, which is a primary target for cybercriminals. The nature of their work in real estate and fiduciary services necessitates a high degree of trust and data integrity, making the alleged breach a significant concern for their operational continuity.

Potential risks and industry implications

This alleged data breach poses several significant risks to the organization, its employees, and its clients. The exposure of personal data, employment contracts, and certificates creates a high risk of identity theft. Furthermore, the theft of financial and contact information can be leveraged to launch targeted phishing attacks against the organization's stakeholders. Such attacks often use the stolen context to appear legitimate, increasing the likelihood of successful social engineering.

Because the institution is based in Switzerland, the breach could lead to complex compliance issues under the Federal Act on Data Protection (FADP). Organizations in the professional services sector must navigate strict regulatory frameworks regarding the handling and protection of client data. The potential for legal and regulatory scrutiny following a breach is a significant concern for firms operating in highly regulated European markets.

The 8base group appears to be utilizing a double extortion strategy. In this model, attackers not only encrypt a victim's systems but also threaten to release stolen data publicly to damage the organization's commercial reputation. This tactic is particularly effective against service-oriented firms where reputation and client trust are the foundations of the business. Despite previous interventions in early 2025, the group's ability to continue operations suggests that similar attacks may persist in the threat landscape.

To mitigate such risks, organizations in this sector typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees. Additionally, maintaining offline, immutable backups and implementing strict data access controls are essential steps in defending against the threat of data exfiltration and subsequent extortion.