J.T. Cullen Co., Inc. listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: United States
• Sector: Manufacturing
• Announcement date: September 25, 2023

8base claims a ransomware attack against J.T. Cullen Co., Inc.

The threat actor known as 8base has listed J.T. Cullen Co., Inc. on its leak site, claiming to have carried out a ransomware attack. According to the group's announcement, the compromise of the company's data occurred on September 25, 2023. The threat actor alleges that various documents, purportedly obtained from the organization, have been uploaded to their servers.

Ransomware attacks often involve a process where attackers gain unauthorized access to a network to encrypt files or steal sensitive information. Many modern ransomware groups utilize a tactic known as double extortion. In this scenario, attackers do not merely encrypt the victim's data to disrupt operations; they also exfiltrate sensitive information to a remote server. The attackers then threaten to leak this stolen data on public leak sites if a ransom is not paid, thereby increasing the pressure on the victim to comply.

Data types allegedly involved in the breach

The announcement from the 8base group claims that a variety of corporate and personal documents have been leaked. The group alleges that the stolen information includes several categories of sensitive files, which may impact both the business operations and the privacy of individuals associated with the firm. The specific items mentioned in the claim include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts

While the group has published these claims on their leak site, the exact volume of the data or the specific number of files involved has not been disclosed by the attackers.

About J.T. Cullen Co., Inc.

J.T. Cullen Co., Inc. is an employee-owned (ESOP) custom metal fabrication company based in Fulton, Illinois. For over 60 years, the company has been producing large and unique metal fabrications for various industries, including power, steel mill, architectural, and rail sectors.

Analysis and potential impact

This alleged breach may pose a risk of exposure for the personal data of the company's employees and business partners. As a company operating in the manufacturing sector, the disclosure of trade and financial data could negatively impact the company's competitive position and potentially lead to secondary fraud attempts. Given that the company is based in the US, legal processes under state-level data privacy laws may be triggered.

Considering the 8base group's double-extortion tactics, it is possible that the leaked data could be used for identity theft or targeted phishing attacks. The group, which has been active since 2022, is known to use Phobos-variant encryptors. Despite operational interventions in early 2025, it is assessed that they may continue their operations.

For organizations in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular employee training to recognize phishing attempts. Furthermore, monitoring for unauthorized data exfiltration and maintaining strict access controls can help mitigate the impact of such breaches. As threat actors continue to target industrial sectors, maintaining a proactive security posture remains a critical component of operational resilience.