Grupo Bébécar listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Portugal
• Sector: Manufacturing
• Announcement date: December 21, 2024

The threat actor known as 8base has listed data allegedly belonging to Grupo Bébécar on its dedicated leak site. This announcement, made on December 21, 2024, suggests that the multinational manufacturing company has been targeted in a ransomware-related incident. While the group has claimed the attack occurred around December 1, 2024, no specific details regarding the total volume of data stolen or the specific ransom demand have been provided by the attackers.

The details of the alleged attack

According to the announcement on the 8base leak site, the group has declared a ransomware incident involving Grupo Bébécar. The threat actors claim that various files were successfully exfiltrated from the company's internal servers. This method of operation is characteristic of a double-extortion strategy. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the stolen data on a public leak site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of their proprietary and private information.

Ransomware leak sites serve as a platform for these threat actors to exert maximum psychological and reputational pressure. By publicly listing a victim, the group signals to the world that the breach is real and that the organization's data is at risk of being leaked to the public or competitors. This tactic significantly increases the stakes for the victim, as the consequences of a leak often extend far beyond the immediate operational downtime caused by encryption.

The types of data allegedly exfiltrated

The information presented in the leak site listing, supported by screenshots, indicates that a wide variety of sensitive documents have been targeted. The exfiltrated data appears to span multiple departments, including finance, human resources, and legal. The specific categories of data mentioned in the claim include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Personal files

The breadth of this data suggests a significant breach of the company's internal documentation. The presence of employment contracts and personal files indicates that the privacy of individual employees may be at risk, while the inclusion of accounting documents and invoices points toward a compromise of the company's financial integrity.

About Grupo Bébécar

Grupo Bébécar is a multinational company with over 50 years of experience in designing and manufacturing baby products. Operating its production in Europe, the company specializes in high-quality strollers and childcare equipment that meet rigorous safety standards. Given its long-standing presence in the manufacturing sector, the company maintains complex supply chains and significant amounts of sensitive operational and personal data.

Analysis and potential implications

This incident may increase the risk of identity theft or targeted phishing attacks against employees and business partners of Grupo Bébécar. The alleged exfiltration of accounting and contractual data could potentially compromise the company's trade secrets and operational security. Furthermore, as a company based in Portugal, this situation may trigger legal processes under GDPR regulations before data protection authorities.

The threat actor 8base is known as a group active since 2022, utilizing Phobos-derived encryptors. Despite operational interventions in early 2025, the group may continue to pose threats using similar methods. For organizations in the manufacturing sector, such incidents highlight the necessity of robust data protection measures. To mitigate such risks, companies often implement multi-factor authentication, regular offline backups, and strict access controls to ensure that sensitive files are not easily accessible to unauthorized actors. Additionally, fulfilling data breach notification obligations and informing affected parties is a critical step in managing the aftermath of such a security event.