GNK Golf listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Spain
• Sector: Hospitality
• Announcement date: December 21, 2024

8base claims data breach against GNK Golf

The 8base ransomware group has listed the Spanish hospitality organization GNK Golf on its dedicated leak site. According to the announcement made on December 21, 2024, the threat actor group claims to have gained unauthorized access to the organization's systems. The group asserts that the initial breach occurred on December 1, 2024.

The threat actors are employing a double extortion tactic in this incident. In a double extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information prior to the encryption phase. The group then threatens to publish this stolen data on their public leak site if their demands are not met. This method increases the pressure on the victim, as the threat of a public data exposure can cause significant reputational and legal damage regardless of whether the organization can restore its systems from backups.

Claimed exfiltrated data types

Based on screenshots provided by the 8base group, the attackers claim to have successfully exfiltrated a wide variety of sensitive documents and personal files. The information allegedly stolen includes various administrative, financial, and legal records that could be used to target individuals or the company itself.

The specific data types mentioned in the claim include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Personal files

No specific information was provided regarding the total size of the data stolen or the specific number of files involved in the breach.

About GNK Golf

GNK Golf is a specialized golf tourism company operating within the Murcia region of Spain. The organization manages a portfolio of three distinct golf courses, all of which were designed by Nicklaus Design. As a company operating in the hospitality and tourism sector, it manages various client and employee interactions that involve sensitive information.

Risk assessment and industry implications

The exposure of the claimed data presents several significant risks. For the employees and customers of GNK Golf, the theft of personal files, employment contracts, and personal data could lead to secondary risks such as identity theft and highly targeted phishing attacks. When attackers possess specific details like certificates or accounting documents, they can craft much more convincing social engineering campaigns.

Furthermore, because GNK Golf operates within Spain, the exposure of personal data may trigger legal sanctions under the European Union's General Data Protection Regulation (GDPR). Organizations operating in the European market must adhere to strict data protection standards, and breaches involving personal information often necessitate formal reporting to regulatory authorities and can result in substantial fines.

The 8base group is a known entity that has been active since 2022. The group is recognized for utilizing Phobos-variant encryptors during their campaigns. Notably, the group has demonstrated resilience, continuing its operations despite various infrastructure interventions conducted in early 2025. This persistence highlights the ongoing challenge posed by established ransomware groups.

For organizations in the hospitality sector, such incidents underscore the importance of robust operational continuity and reputation management. To mitigate such risks, companies often implement defensive strategies such as multi-factor authentication, regular offline backups, and strict access controls to limit the movement of attackers within a network. Maintaining a comprehensive incident response plan is also vital to managing the potential fallout from both operational disruptions and the public exposure of sensitive data.