Pim listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: India
• Sector: Agriculture and Food Production
• Announcement date: April 3, 2024

The 8base ransomware group has officially listed Pim, a prominent player in the fertilizer and petrochemical industry, on its dedicated leak site. According to an announcement made on April 3, 2024, the threat actors claim to have successfully compromised the organization's systems and exfiltrated sensitive information. This development marks the latest instance of the group targeting industrial sectors through high-pressure extortion tactics.

The claimed attack and extortion method

The threat actor known as 8base has published a leak announcement claiming to have compromised data belonging to Pim. In the post, the group provides details regarding the company's operations and alleges that various corporate and personal documents have been exfiltrated during the breach. This incident follows a pattern of behavior common among modern ransomware collectives, where the goal is not merely to encrypt local systems but to steal information to increase leverage.

The group is employing double extortion tactics by threatening to publish the acquired data if their demands are not met. Double extortion is a sophisticated method where attackers first steal sensitive data and then demand payment to prevent its public release. This approach creates a dual pressure point for the victim: the immediate operational disruption caused by encryption and the long-term reputational and legal risks associated with a public data leak. By threatening to expose the information, the attackers aim to maximize the likelihood of receiving a ransom payment.

The scope of the alleged data breach

While the specific volume of the stolen data and the exact ransom demand have not been disclosed by the group, the announcement provides a detailed list of the types of information that have allegedly been compromised. The group claims to have access to a wide variety of sensitive documents that could impact both the company's operations and the privacy of its individuals.

The information allegedly included in the leak consists of the following:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Personal files

About Pim

PIM (PT Pupuk Iskandar Muda) is an Indonesia-based fertilizer and petrochemical manufacturer. The company operates in the production and distribution of fertilizers for the agricultural sector and the trade of chemical products.

Analysis and potential impact

The 8base group is known as an entity active since 2022 that utilizes Phobos-variant encryptors. Despite international operations against the group's infrastructure in early 2025, it appears that the group continues its activities. The potential exposure of the company's data may lead to secondary risks such as identity theft or targeted phishing attacks against employees and customers.

The inclusion of employment contracts and confidentiality agreements in the alleged leak could result in the disclosure of trade secrets and damage the company's competitive advantage. Furthermore, the organization may face regulatory scrutiny and administrative penalties regarding data privacy violations within its jurisdiction. For organizations operating in the agriculture and chemical sectors, such breaches highlight the necessity of robust data protection frameworks and incident response plans to mitigate the impact of exfiltration-based attacks.