SMG Confrere listed on 8base leak site

• Ransomware group: 8base
• Country: France
• Sector: Manufacturing
• Announcement date: December 6, 2023

8base claims data breach against SMG Confrere

The threat group known as 8base has published a listing on its leak site claiming to have compromised data belonging to SMG Confrere. This announcement, which appeared on the group's platform, suggests that the organization has been targeted in a cyberattack. While the group has made various file samples available for download to demonstrate their claims, the incident highlights the ongoing risks faced by industrial entities in the modern threat landscape.

The listing of SMG Confrere by 8base is viewed as a tactical move within the group's broader operational strategy. By publishing the names of victim organizations and providing evidence of the stolen information, the group aims to increase the pressure on the target. This approach is a hallmark of the double-extortion method, a common ransomware tactic where attackers not only encrypt an organization's systems but also threaten to leak sensitive information to the public unless a ransom is paid.

Claimed data types and contents

According to the claims made by the 8base group, the stolen information consists of a wide variety of sensitive corporate and personal documents. The group alleges that the breach includes a range of files that could impact both the internal operations of the company and the privacy of its stakeholders. The specific types of data reportedly involved in this incident include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Other corporate files

The presence of such diverse documentation suggests that the attackers may have gained access to various administrative and human resources directories within the organization's network.

About SMG Confrere

SMG Confrere is a French company that has been operating since 1947. The organization specializes in sheet metal processing and the manufacturing of mechanical parts designed for various industrial applications. Based in Saint-Paul-en-Oise, the company provides specialized metalworking solutions to a diverse range of industrial sectors, making it a significant player in the manufacturing landscape.

Implications and industry risks

The breach of SMG Confrere carries several significant risks. For the organization, the exposure of such sensitive data can lead to substantial reputational damage and the potential disclosure of trade secrets. Furthermore, because the company operates within France, it is likely that the organization could face legal sanctions under the General Data Protection Regulation (GDPR) if the leaked data is confirmed to contain personal information of EU citizens.

Beyond the legal and corporate risks, there is a heightened risk to individuals. The exposure of employment contracts, personal data, and certificates increases the risk of identity theft or targeted phishing attacks against SMG Confrere's employees and business partners. Attackers often use stolen corporate information to craft highly convincing social engineering campaigns, which can further compromise the security of the organization's supply chain.

The 8base group, whose infrastructure was disrupted in early 2025, is known to utilize Phobos-variant encryptors for its operations. This type of ransomware is particularly dangerous due to its ability to disrupt business continuity through encryption while simultaneously using the threat of data disclosure to extort victims. In such scenarios, organizations are often required to fulfill data breach notification obligations and inform all affected parties to mitigate further harm.

For organizations in the manufacturing sector, this incident serves as a reminder of the necessity for robust cybersecurity frameworks. Defensive measures typically include implementing strict access controls, maintaining offline backups, and conducting regular security awareness training to defend against phishing. As threat actors continue to employ double-extortion tactics, the ability to detect and respond to unauthorized access before data exfiltration occurs remains a critical component of organizational resilience.