Royal insignia listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Singapore
• Sector: Professional Services
• Announcement date: February 28, 2024

8base claims data exfiltration from Royal Insignia

The 8base ransomware group has officially listed the Singapore-based organization Royal Insignia on their dedicated leak site. Through this announcement, the threat actor claims to have successfully exfiltrated various types of corporate and personal data from the company's systems. This development follows a pattern of activity where ransomware groups use public leak portals to pressure victims by threatening the release of sensitive information.

According to the announcement published on February 28, 2024, the group claims to have gained unauthorized access to the organization's internal systems. By penetrating these networks, the attackers assert they were able to extract a wide range of files. This type of activity is characteristic of modern ransomware operations, where the primary goal is not just the encryption of local files, but the theft of data to be used for extortion purposes.

The scope of the alleged data breach

The leak announcement provided by the 8base group specifies several categories of sensitive information that were allegedly stolen during the unauthorized access. The listed data types suggest a significant breach of both administrative and personal information. The items mentioned in the claim include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements

The presence of such diverse documentation, ranging from financial records like invoices and receipts to highly sensitive legal documents such as employment contracts and confidentiality agreements, indicates a broad reach into the organization's digital environment. No specific information was provided regarding the total size of the data stolen or the exact number of files involved.

About Royal Insignia

Royal Insignia is a luxury brand headquartered in Singapore. The organization specializes in the manufacturing of high-end items, including medals, jewelry, and bespoke fine gifts. Their client base is highly prestigious, serving royal families and various government ministries on a global scale. Given the nature of their business and their high-profile clientele, the organization operates in a sector where discretion and the protection of sensitive client and governmental information are of paramount importance.

Threat analysis and potential implications

The 8base group is identified as a double-extortion threat actor. This method involves both encrypting an organization's data to disrupt operations and stealing the data to threaten its public release. The group is reported to utilize Phobos-variant ransomware in their operations. Such attacks pose a significant risk to the victims, as the threat of leaking sensitive information can lead to severe consequences even if the organization can restore its systems from backups.

For an organization like Royal Insignia, this breach may lead to several critical issues. The exposure of personal data and employment contracts could facilitate identity theft or enable targeted phishing attacks against the organization's employees and customers. Furthermore, the breach may result in negative impacts on the organization's commercial reputation and its ability to maintain operational continuity. Because the organization is based in Singapore, this incident may trigger legal proceedings under the relevant local data protection regulations.

It is worth noting that despite previous interventions against the 8base group's infrastructure in early 2025, the group appears to remain active. Organizations in the professional services and luxury manufacturing sectors often face these types of sophisticated threats. To mitigate such risks, companies typically focus on robust access controls, continuous monitoring of network traffic to detect unauthorized exfiltration, and comprehensive employee training to prevent initial access via phishing.