Forstinger Österreich GmbH listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Austria
• Sector: Professional Services
• Announcement date: March 13, 2024

Austrian automotive supplier targeted by 8base ransomware group

The 8base ransomware group has officially listed the Austrian-based organization Forstinger Österreich GmbH on its dedicated leak site. According to the announcement made on March 13, 2024, the threat actor group claims to have successfully breached the organization's systems and exfiltrated various corporate documents. This listing serves as a direct threat against the ongoing operations of the organization, as the group utilizes these platforms to exert pressure on their targets.

Details of the claimed breach

The 8base group claims to have gained unauthorized access to the internal systems of Forstinger Österreich GmbH. The announcement, which appeared on the group's leak site on the same day it was allegedly carried out, indicates that the attackers have obtained a variety of sensitive corporate files. While the specific volume of data and the exact number of files stolen have not been disclosed by the group, the claim of access to the organization's infrastructure is central to their extortion attempt.

The group's announcement includes screenshots that allegedly demonstrate the nature of the stolen information. Based on the available evidence provided by the attackers, the exfiltrated data is said to include a wide range of sensitive documents, such as:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Other personal files

About Forstinger Österreich GmbH

Forstinger Österreich GmbH is a prominent supplier based in Austria, specializing in automotive accessories and spare parts. The company maintains a significant retail presence with over 70 stores. Their product catalog is diverse, catering not only to standard car owners but also to specific enthusiast markets, including motorcyclists, cyclists, and outdoor enthusiasts.

Potential risks and implications of the leak

The disclosure of such a wide array of data carries significant secondary risks for both the organization and the individuals involved. For the employees and customers of Forstinger Österreich GmbH, the theft of personal data, employment contracts, and certificates may lead to heightened risks of identity theft and targeted phishing attacks. These types of social engineering attacks often leverage stolen personal information to gain further access to systems or to defraud individuals.

Furthermore, the 8base group is recognized as a double-extortion actor. This methodology involves two distinct layers of pressure: first, encrypting the victim's systems to disrupt operations, and second, threatening to leak sensitive data on public platforms to force a ransom payment. This dual approach increases the pressure on organizations, as the threat of public exposure remains even if systems are restored from backups.

From a regulatory perspective, because the organization operates within Austria, it is subject to strict data protection laws. Failure to meet the obligations regarding the protection of personal data under the General Data Protection Regulation (GDPR) could result in significant administrative sanctions. Additionally, the exposure of trade secrets and sensitive employee information poses a threat of long-term reputational damage and can lead to substantial operational disruptions for the company.

In general, organizations operating in the professional services and retail sectors can mitigate such risks by implementing robust security frameworks. This includes maintaining strict access controls, conducting regular security audits, and ensuring that all employees are trained to recognize phishing attempts. Additionally, maintaining offline, immutable backups and implementing strong encryption for data at rest and in transit are standard defensive measures against ransomware and data exfiltration.