Lyons Specialty Co. listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: United States
• Sector: Professional Services
• Announcement date: January 3, 2025

8base claims data breach at Lyons Specialty Co.

The ransomware group known as 8base has officially listed Lyons Specialty Co. on its leak site. Through this announcement, the threat actor claims to have successfully exfiltrated sensitive data belonging to the organization. This development indicates that the company's operational data may be at significant risk following the alleged compromise.

The group is employing a double-extortion strategy in this incident. In such attacks, threat actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the stolen data on their public leak site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of their private information.

The announcement was posted on January 13, 2025, following a claimed attack date of January 3, 2025. While the group has made these claims, the specific details regarding the volume of data stolen and the exact ransom demand remain unknown, as no information was provided regarding the data size or the financial demands in the leak site announcement.

Claimed sensitive information includes personal and financial records

According to the details provided in the leak, the compromised data is alleged to include a wide variety of sensitive documents and personal identifiers. The breadth of the claimed data suggests a significant breach of both corporate and individual information. The items listed by the threat actor include:

• Receipts
• Tickets
• Driver's licenses
• Credit card details
• Screenshots of conversations
• Accounting documents
• Passports
• Phone numbers
• Email addresses
• Medical records
• Reports
• Car registrations
• Resumes
• Customer data

About Lyons Specialty Co.

Lyons Specialty Co. is a wholesale distributor with over 100 years of experience in the industry. The company provides a wide range of products, including candy, tobacco, groceries, health, and janitorial supplies. Their client base consists of convenience stores, grocery stores, and restaurants. The organization maintains a significant operational footprint across several states in the United States, specifically operating in Louisiana, Mississippi, Arkansas, and Texas.

Analysis and potential risks

The 8base group is a double-extortion actor that has been active since 2022. The group is known for utilizing Phobos-variant encryptors during their campaigns. Despite international law enforcement operations that targeted the group's infrastructure in early 2025, the group appears to remain active in the cybercrime ecosystem.

For a US-based organization like Lyons Specialty Co., this breach may lead to serious secondary risks. The exposure of highly sensitive information, such as passports, driver's licenses, and medical records, increases the likelihood of identity theft for both employees and customers. Furthermore, the nature of the exposed data suggests that the organization could face regulatory scrutiny under HIPAA or various state-level data protection laws.

Beyond the immediate regulatory and identity theft concerns, the incident may increase the risk of targeted phishing campaigns. Attackers often use stolen contact information and conversation screenshots to craft highly convincing social engineering attacks against a company's supply chain partners and customers. In the professional services and wholesale distribution sector, maintaining the integrity of communication and customer data is vital to preventing such cascading security incidents.