Kerkstoel listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Belgium
• Sector: Professional Services
• Announcement date: October 9, 2024

8base claims data breach at Kerkstoel

The 8base ransomware group has officially listed the Belgian organization Kerkstoel on its dedicated leak site. According to the announcement made on October 9, 2024, the threat actor group claims to have successfully compromised the institution's confidential information and personal data. The group alleges that the initial intrusion or data acquisition took place on September 23, 2024.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms by threatening to release stolen information. This specific incident involves a claim of a data breach, a tactic often used to maximize leverage during negotiations. While the group has published a listing, the full extent of the breach remains subject to the claims made by the attackers.

Details of the alleged data theft

The threat actor group has provided screenshots to support their claims regarding the stolen information. The contents of the alleged leak are diverse, encompassing various types of sensitive documentation that could impact both the company's operations and the privacy of individuals associated with the firm. The group claims to have obtained a wide array of files that include business, financial, and personal records.

The specific types of data mentioned in the group's announcement include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Various personal files

The presence of such a wide variety of documents suggests that the attackers may have gained access to internal administrative and human resources systems. This type of data exposure is a hallmark of modern cyber extortion campaigns.

About Kerkstoel

Kerkstoel 2000 is a Belgian construction materials manufacturer. The company specializes in the production of precast concrete floor slabs, insulated twin wall panels, and solid walls. It operates as a component of the larger Kerkstoel Group.

Implications and security considerations

This leak claim may increase the risk of identity theft or targeted phishing attacks for Kerkstoel's employees and business partners. Because the leaked data reportedly includes employment contracts, personal files, and certificates, individuals whose information was taken may face heightened risks of social engineering or fraudulent activities using their stolen credentials and identities.

The 8base group employs a double-extortion method, a strategy where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This approach means the institution may face both operational disruption and reputational damage. Furthermore, the group's history of using Phobos-derived tools and the fact that their infrastructure was disrupted in early 2025 suggests that persistent vulnerabilities could have been exploited within the institution's systems.

Given that the institution operates in Belgium, it is likely that the leaked data will be subject to GDPR regulations, which may trigger mandatory data breach notifications to both regulators and the affected individuals. For organizations in the professional services and manufacturing sectors, such incidents underscore the importance of robust security postures. It may be important for the institution to conduct a forensic investigation to determine the full scope of the leaked data and to identify the specific vulnerabilities that allowed the intrusion to occur.

Defensive measures for organizations typically involve implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training to prevent initial access via phishing. Additionally, maintaining offline backups and implementing network segmentation can help mitigate the impact of both data exfiltration and ransomware encryption.