Semba listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: India
• Sector: Manufacturing
• Announcement date: May 23, 2023

The ransomware group 8base has claimed to have published data belonging to the manufacturing company Semba on its dedicated leak site. This announcement, which appeared on the group's platform, suggests that the organization's information has been compromised by the threat actors.

Details of the claim

According to the listing on the 8base leak site, the group has targeted Semba, alleging that the company's data has been successfully exfiltrated. The announcement provided specific details regarding the company's operations and included a link for file sharing. However, it is important to note that the entry is currently displayed with an 'expired' status on the site.

The claim suggests that the breach may have occurred some time ago, as the group's announcement was made on May 23, 2023, while the claimed attack date is cited as September 7, 2022. This discrepancy in timing is common in ransomware operations, where there is often a significant delay between the initial intrusion and the public disclosure on a leak site.

Data involved in the incident

Regarding the specific information that has been compromised, the group has not provided details concerning the exact nature of the leaked data. No specific file types, data volumes, or ransom demands have been disclosed in the announcement. While the exact contents remain unspecified, the group may have targeted operational or customer-related information during the attack.

The listing names no specific data types.

About Semba

Semba is a cardboard factory that specializes in the manufacture of corrugated cardboard packaging. The company was established to serve the local market within the Indian Ocean region, focusing on the production of packaging solutions for various industrial needs.

Risk assessment and industry implications

This incident may pose significant risks to the company's operational continuity and its commercial reputation. The 8base group is known for employing a double-extortion strategy. In such attacks, threat actors do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish the stolen information, the attackers aim to pressure the organization into paying a ransom to prevent public exposure.

The publication of company data can lead to various secondary consequences. For instance, it could lead to identity theft or facilitate targeted phishing attacks directed at the company's employees and customers. Such attacks often exploit the stolen information to gain further access to the network or to defraud individuals associated with the organization.

Despite the operational interventions conducted against the 8base group in early 2025, the group's past activities serve as a reminder of the ongoing threat landscape. For manufacturing companies of a similar scale, this incident suggests a need to review and strengthen cybersecurity measures. Organizations in this sector often rely on complex supply chains and operational technology, making them attractive targets for ransomware groups seeking to disrupt production or exploit sensitive commercial data. Implementing robust defensive strategies, such as regular security audits and employee awareness training, remains a critical component of modern cybersecurity posture.