LCGB data allegedly listed on 8base leak site

• Ransomware group: 8base
• Country: Luxembourg
• Sector: Government & Defense
• Announcement date: December 20, 2023

8base claims to have stolen data from LCGB

The threat actor known as 8base has listed data allegedly belonging to LCGB on its leak site. According to the announcement made on December 20, 2023, the group claims that the data was obtained directly from the organization's servers.

The event was announced on the group's leak platform on December 20, 2023. The group's claim involves the unauthorized access and extraction of information from the organization's digital infrastructure. This type of activity is common among ransomware groups that utilize leak sites to pressure victims through public exposure.

Data types involved in the alleged leak

The announcement made by the 8base group specifies a wide range of sensitive documents that are purportedly included in the leak. The listed items suggest a significant exposure of administrative and personal documentation. The files mentioned in the claim include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Personal files

While the group has listed these specific categories, no information was provided regarding the total size of the data or the specific file count involved in the incident.

About LCGB

LCGB (Lëtzebuerger Chrëschtleche Gewerkschaftsbond) is a trade union based in Luxembourg. It operates to protect the rights of employees, focusing on social security, retirement, and providing support for young people in the labor market.

Analysis and potential impact

The alleged leak may pose a risk of exposure for the personal data of the organization's employees and members. Given that the organization is based in Luxembourg, the incident may result in data protection violations under GDPR. The use of double extortion tactics by the 8base group suggests that, beyond the publication of data, secondary risks such as identity theft and targeted phishing attacks may emerge.

Double extortion is a common tactic used by modern ransomware groups. In this method, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption begins. The threat of leaking this data on a public site serves as additional leverage to force the victim into paying a ransom. This approach increases the pressure on the organization, as the damage extends beyond operational downtime to include reputational harm and legal liabilities.

The 8base group has been active since 2022 and has been associated with Phobos-variant encryptors. The actions of this group may create negative impacts on the organization's operational credibility. For organizations in the government and defense sector, or those handling sensitive social and employment data, maintaining the integrity and confidentiality of information is critical to maintaining public and member trust.

To mitigate such risks, organizations typically focus on robust defensive measures. This includes implementing strong access controls, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts. Furthermore, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations, such as GDPR, are essential components of a modern cybersecurity posture. The potential for secondary attacks, such as identity theft or targeted phishing using stolen employment contracts and personal files, highlights the need for continuous vigilance even after an initial incident has been addressed.