ModernGrab, S.A. listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Spain
• Sector: Manufacturing
• Announcement date: November 15, 2023

The Spanish manufacturing company MODERNGRAB, S.A. has been listed on the leak site associated with the 8base ransomware group. According to the announcement made by the threat actors, the organization's systems were compromised, leading to the potential exposure of sensitive corporate and personal information.

The claimed attack and extortion method

The 8base group has claimed to have obtained access to the systems of MODERNGRAB, S.A. on November 15, 2023. By publishing the alleged stolen information on their public leak site, the group appears to be utilizing double-extortion tactics. In a typical double-extortion scenario, ransomware actors do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. The threat of releasing this data publicly is used to pressure the victim into paying a ransom, as the organization faces reputational damage and legal consequences if the data is leaked.

Ransomware leak sites serve as a platform for these groups to host stolen data and issue ultimatums to their victims. These sites are a central component of modern cybercriminal business models, allowing groups to maintain visibility and increase the psychological pressure on targeted entities. While the specific ransom demand and the total volume of data stolen have not been disclosed in the announcement, the act of listing the company is a clear indication of the group's intent to cause harm through data exposure.

Alleged data types involved in the breach

Based on the information provided in the leak site announcement, the data allegedly stolen from MODERNGRAB, S.A. includes a wide variety of sensitive documents. The files mentioned suggest that the breach impacts multiple departments within the company, ranging from human resources to finance and legal operations. The specific types of data identified include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Various personal files

The presence of such diverse documentation indicates that the attackers may have had broad access to the internal file servers and databases of the organization.

About MODERNGRAB, S.A.

MODERNGRAB, S.A. is a Spanish company with over 40 years of experience in the field of prepress solutions. The company specializes in the manufacturing of rotogravure cylinders and flexography plates. Notably, the firm was the first Spanish company to implement an automatic rotogravure production line, marking a significant milestone in its industrial operations within the manufacturing sector.

Risks and implications of the incident

This incident poses significant risks to the personal data of both employees and customers of MODERNGRAB, S.A. Because the organization is based in Spain, the exposure of personal information could potentially lead to legal sanctions under the General Data Protection Regulation (GDPR). Such regulatory scrutiny often follows data breaches involving European entities, as authorities investigate whether sufficient technical and organizational measures were in place to protect sensitive information.

Beyond legal and regulatory risks, the publication of financial and operational data creates secondary threats. These include the potential for identity theft and the execution of targeted phishing attacks against the individuals whose information was leaked. Attackers can use the details found in employment contracts or accounting documents to craft highly convincing social engineering campaigns.

Given the historical activities of the 8base group, it is evident that they aim to maximize pressure on institutions through these double-extortion methods. Despite operational interventions that occurred in 2025, the potential for this group to continue its activities using similar methods remains a concern for the cybersecurity community. Organizations in the manufacturing sector should prioritize robust defensive measures, such as multi-factor authentication, regular security audits, and comprehensive data encryption, to mitigate the impact of such targeted attacks.