Keystone Insurance Services targeted by 8base ransomware group

• Ransomware group: 8base
• Country: United States
• Sector: Financial Services
• Announcement date: August 15, 2023

The 8base ransomware group has claimed to have published data belonging to Keystone Insurance Services on its leak site. According to the announcement made on August 15, 2023, the threat actor alleges that they gained access to the organization's network on the same day the claim was posted.

The alleged attack and extortion method

The threat actor known as 8base has listed data allegedly belonging to Keystone Insurance Services on its leak platform. The announcement suggests that access to the organization's network was obtained on August 15, 2023. By listing the organization's data, the group aims to exert pressure through a method known as double extortion.

Double extortion is a common tactic used by modern ransomware groups. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. The group then threatens to leak this stolen data on public forums or specialized leak sites if a ransom is not paid. This approach increases the pressure on the victim, as the threat of public exposure can lead to significant reputational damage, regulatory scrutiny, and legal liabilities, even if the organization can restore its systems from backups.

The scope of the claimed data breach

The announcement lists a wide variety of sensitive documents and personal information that the group claims to have acquired. The stolen data reportedly includes a range of internal and personal files, such as:

• Invoices
• Receipts
• Accounting documents
• Certificates
• Employment contracts
• Confidentiality agreements
• Employee personal files
• Client personal files
• Personal documentation
• Correspondence
• Data regarding employees and partners
• Various internal documents

The presence of such a diverse set of documents suggests a significant breach of organizational and personal information. No information was provided regarding the total size of the data or the specific number of files involved in the leak.

Organization profile

Keystone Insurance Services is an independent insurance agency based in Utah. They provide comprehensive insurance policies for various needs, including home, life, auto, dental, and earthquake insurance.

Implications and security considerations

This incident indicates that employees and clients of Keystone Insurance Services may face risks of identity theft due to the nature of the leaked information. Given that the organization is based in the United States, the leaked data could lead to legal consequences under state-level data protection laws and industry regulations.

The 8base group's use of the double extortion method demonstrates a clear intent to exert financial pressure on the organization through the threat of data publication. Such attacks can lead to secondary risks for stakeholders, including an increase in targeted phishing attacks and secondary fraud attempts directed at the organization's clients and partners.

While the infrastructure of the 8base group, which has been active since 2022, was disrupted in early 2025, their past activities serve as a reminder for organizations to review their data security processes. To defend against such threats, organizations typically focus on implementing robust access controls, monitoring for unauthorized data exfiltration, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.