Onsupport Corporation listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: United States
• Sector: Professional Services
• Announcement date: June 19, 2023

8base claims data compromise of Onsupport Corporation

The threat actor known as 8base has officially listed Onsupport Corporation on its dedicated leak site. According to the announcement made by the group, the organization's data has been compromised. The group claims that the breach occurred on June 19, 2023, and they are currently utilizing a double-extortion strategy regarding the publication of this information.

Double-extortion is a common tactic employed by modern ransomware groups. In this method, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The attackers then threaten to leak this stolen information on public forums or leak sites if the ransom is not paid. This approach significantly increases the pressure on the victim, as the threat of public exposure can cause irreparable damage to a company's reputation and lead to severe regulatory scrutiny.

Details of the alleged data exfiltration

The leak site announcement provided specific details regarding the types of information that the 8base group claims to have obtained during the attack. The listed items suggest a significant breach of sensitive corporate and personal information. According to the group, the compromised data includes:

• Receipts
• Financial documents
• Contracts
• W9 forms
• Internal documents
• Personal data

The presence of such diverse data types, ranging from financial records to personal identifiers, highlights the potential impact of the alleged breach on various stakeholders within the organization.

Organizational profile and context

Onsupport Corporation is an entity operating within the professional services sector. Based in the United States, the company is subject to the various legal frameworks governing data protection and privacy within the US. The specific nature of the data claimed to be stolen—including financial documents and personal data—suggests that the organization may face significant legal consequences under both federal and state-level data protection laws and regulations.

Analysis and potential impact of the breach

The 8base group has been an active threat actor since 2022 and is recognized for utilizing Phobos-variant encryptors. The group's infrastructure was previously targeted in early 2025, yet they appear to continue exerting pressure on victims through such leak announcements. For an organization in the professional services sector, the implications of such an event are multifaceted.

The exposure of the alleged data poses secondary risks that extend beyond the immediate incident. For employees and customers, the theft of personal data and internal documents can lead to identity theft or the execution of highly targeted phishing attacks. These secondary attacks often exploit the specific details found in stolen contracts or financial documents to gain further trust from the victims.

Furthermore, the use of double-extortion methods can negatively impact an organization's operational continuity and long-term reputation. When sensitive internal documents and client-facing contracts are leaked, it can erode the trust that clients place in a professional services firm. To mitigate such risks, organizations typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging to detect unauthorized data movement, and ensuring that data is encrypted both at rest and in transit. Regular security audits and employee training regarding phishing awareness are also standard industry practices used to defend against the types of extortion tactics employed by groups like 8base.