PrintGlobe, Inc. listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: June 19, 2023

The 8base ransomware group has officially listed PrintGlobe, Inc. on its leak site, claiming to have successfully exfiltrated data belonging to the organization. This announcement, made on June 19, 2023, suggests that the company's network security was compromised, allowing unauthorized access to its internal systems and various sensitive files.

The details of the alleged attack

According to the claims made by the 8base group, the breach involved unauthorized access to the company's network. The group alleges that the data exfiltration occurred on June 19, 2023. Following the theft of this information, the threat actors are reportedly utilizing double extortion tactics against the organization.

Double extortion is a common ransomware strategy where attackers do not merely encrypt a victim's files to disrupt operations, but also steal sensitive data beforehand. By threatening to leak this stolen information on public forums or leak sites, the attackers create additional pressure on the victim to pay the ransom, leveraging the threat of reputational damage and regulatory scrutiny. This method significantly increases the impact of a cyberattack, as the organization faces risks even if they can successfully restore systems from backups.

The types of data allegedly stolen

The announcement from the 8base group specifies that a wide variety of sensitive information was included in the data they claim to have downloaded. The stolen information is said to encompass both corporate and personal records, potentially exposing the company's internal operations and its client base. The types of data mentioned in the listing include:

• Receipts
• Invoices
• Accounting files
• Transaction records
• Email and phone databases
• Internal documents
• Certificates
• Personal data

The presence of such diverse data types—ranging from financial records like invoices and accounting files to communication databases and personal information—indicates a significant breach of the organization's data perimeter.

About PrintGlobe, Inc.

PrintGlobe, Inc. is a supplier established in 1995 that specializes in personalized promotional items and custom-printed merchandise. Based in Austin, Texas, the company provides wholesale and custom design product solutions to various industries.

Analysis and potential implications

The alleged exfiltration of this data may pose significant secondary risks to both the company's employees and its customers. Specifically, the theft of personal data, email databases, and phone records can lead to identity theft and highly targeted phishing attacks. When attackers possess specific transaction records or internal documents, they can craft much more convincing social engineering campaigns against the organization's stakeholders.

Furthermore, as a United States-based entity, PrintGlobe, Inc. may face legal proceedings under relevant state laws and federal data protection regulations due to the exposure of personal and financial information. The organization may also experience negative impacts on its operational continuity, especially considering that the 8base group is known to utilize Phobos-variant encryptors. Such encryption can halt business processes and disrupt the supply chain.

The use of double extortion methods can lead to lasting reputational damage and harm to the company's established business relationships. It is also worth noting that despite recent international interventions aimed at disrupting the infrastructure used by the 8base group, these types of announcements suggest that the risks regarding the group's ongoing activities may persist. Organizations in the retail and e-commerce sectors should prioritize robust network security, regular data encryption, and comprehensive employee training to mitigate the risks of such sophisticated extortion campaigns.