MBS Equipment TTI listed on 8base leak site

• Ransomware group: 8base
• Country: United States
• Sector: Manufacturing
• Announcement date: August 1, 2023

8base claims data breach against MBS Equipment TTI

The threat actor group known as 8base has officially listed MBS Equipment TTI on its leak site, claiming that the organization has been targeted in a cyberattack. According to the announcement made by the group, various types of corporate and personal data belonging to the company have been compromised. The incident is alleged to have occurred on August 1, 2023.

The 8base group appears to be employing double extortion tactics in this instance. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information beforehand. The threat actors then threaten to publish this stolen data on their public leak site to pressure the victim into paying a ransom. By leveraging the threat of public exposure, the attackers aim to maximize their leverage over the target organization.

Details of the alleged data compromise

The announcement provided by the threat actors includes general information regarding the company's operations and outlines the specific categories of information they claim to have exfiltrated. The group alleges that the compromised data includes a wide range of sensitive documents and personal identifiers. According to the listing, the stolen information consists of the following:

• Employment contracts
• Personal data of employees
• Agreements
• Accounts
• Invoices
• Accounting documents
• W-9 forms
• Correspondence
• Social Security Numbers (SSN)
• Driver's licenses
• Passports

The inclusion of highly sensitive identity documents, such as passports and Social Security Numbers, significantly elevates the severity of the alleged breach. No information was provided regarding the total size of the data stolen or the specific amount of the ransom demand requested by the group.

About MBS Equipment TTI

MBS Equipment TTI operates as part of The MBS Group, which is described as a premier global studio operator and provider of production services. As a division of this group, MBS Equipment focuses on offering lighting, grip, and production equipment solutions specifically tailored for the film and television industry.

Impact and security implications

This incident may increase the risk of identity theft and targeted phishing attacks for the company's employees and business partners. The alleged compromise of sensitive data, particularly highly regulated identifiers like passports and Social Security Numbers, could trigger data breach notification requirements under relevant regulations. Such requirements are often designed to ensure that individuals are informed when their private information is at risk.

The 8base group is a known threat actor that has been active since 2022. This group is recognized for utilizing Phobos-variant encryptors in their operations. While the group's infrastructure was disrupted in early 2025, the fallout from such leaks can create long-term negative impacts on a company's operational continuity and reputation management. Even when threat actor infrastructure is taken down, the data already leaked remains in the public domain, posing a persistent risk to the affected parties.

For organizations in the manufacturing and production services sectors, such incidents highlight the importance of robust data protection strategies. Defensive measures typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against phishing. Furthermore, monitoring for unauthorized data exfiltration and maintaining strict access controls for sensitive documents like employment contracts and financial records are critical steps in mitigating the impact of potential ransomware attacks.