Originpath Group listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Spain
• Sector: Technology
• Announcement date: December 6, 2024

8base claims data exfiltration against Originpath Group

The ransomware group known as 8base has officially listed the Spanish technology company Originpath Group on its dedicated leak site. According to the announcement made on December 6, 2024, the threat actors claim to have successfully carried out a cyberattack against the organization, which allegedly took place on November 30, 2024. The group asserts that they have obtained various documents from the company's servers during this operation.

The nature of this incident suggests the potential use of a double-extortion strategy. In such scenarios, ransomware groups do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish or sell the stolen data on the dark web, attackers increase the pressure on the victim to meet their demands. This tactic is designed to maximize the impact of the attack by targeting the confidentiality of the organization's information rather than just its availability.

Alleged data types involved in the breach

The announcement provided by 8base specifies a wide range of sensitive documents that were allegedly stolen from the organization. The list of exfiltrated information includes various administrative, financial, and personal records that could pose significant risks if released publicly. The claimed data includes:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Personal files

No information was provided regarding the total size of the data stolen or the specific number of files involved in the breach. Furthermore, the group has not issued a specific ransom demand in the public announcement.

About Originpath Group

Originpath Group is a company based in Spain that operates within the technology sector. The organization specializes in research and development (R&D) and software development, specifically focusing on the legaltech industry. Their technical expertise is centered on creating software solutions for the legal sector, with a primary focus on environments involving artificial intelligence, machine learning, and cloud computing.

Analysis and potential impact of the incident

The alleged leak poses a significant risk to the personal data of both the employees and the clients of Originpath Group. Because the organization is based in Spain, any confirmed breach of this nature could trigger administrative sanctions and legal proceedings under the General Data Protection Regulation (GDPR). The presence of highly sensitive documents, such as employment contracts and confidentiality agreements, in the hands of threat actors may result in direct damage to the company's trade secrets and intellectual property rights.

Furthermore, the use of the double-extortion method by 8base increases the likelihood that the stolen data will be utilized in secondary attacks or for identity theft. Given the group's historical association with using Phobos-variant encryptors, it is possible that the organization's operational continuity has also been impacted by this incident. When organizations face such threats, maintaining robust security postures is essential.

In the technology and legaltech sectors, protecting intellectual property and sensitive client data is paramount. Organizations in these fields often focus on implementing strong access controls, encryption for data at rest and in transit, and continuous monitoring of their cloud computing environments. Additionally, maintaining a clear incident response plan and ensuring regular backups can help mitigate the operational disruptions often caused by ransomware groups.