SOVAC listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Belgium
• Sector: Professional Services
• Announcement date: May 23, 2023

The Belgian-based professional services company SOVAC has been listed on the leak site of the 8base ransomware group. The threat actor group has published an announcement claiming that data belonging to the organization has been compromised, marking a potential security incident for the Belgian firm.

The claimed attack and event details

According to the announcement published by the 8base group, the organization's data has been targeted. The group's post includes general information regarding the operations of SOVAC and provides a Mega.nz link that allegedly contains the stolen information. While the group has made this claim, the listing currently appears with an "expired" status on their platform.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms by threatening to release sensitive information. In many cases, these groups employ double-extortion tactics. This method involves not only encrypting an organization's files to disrupt operations but also stealing sensitive data beforehand. The threat actors then threaten to publish this data online if the ransom is not met, creating a dual layer of pressure on the victim.

Data involved in the claim

The group has not provided specific details regarding the exact content of the leaked data. However, the announcement implies that data belonging to the company's employees and customers may be at risk due to the alleged compromise.

• Employee data
• Customer data

The listing names no specific data types beyond these general categories. No information was provided regarding the total size of the data, the specific file count, or the amount of the ransom demand requested by the group.

About SOVAC

SOVAC is a specialist supplier located in the Overijse region of Belgium. Operating since 1945, the company provides a wide range of products to professional heating system installers. Their inventory includes spare parts, tools, and equipment for heating installations, such as burner parts, boiler components, and central heating accessories.

Analysis and potential implications

The 8base group is a known threat actor that is recognized for employing double-extortion tactics and utilizing Phobos-variant encryptors. The exposure of corporate data in such incidents can lead to significant secondary risks, including identity theft or the launching of targeted phishing attacks against the affected parties.

Because SOVAC operates within Belgium, this incident may trigger legal and administrative sanctions under the General Data Protection Regulation (GDPR). Such regulations are designed to protect the privacy of individuals, and a breach involving personal data often necessitates formal reporting and compliance with strict regulatory frameworks.

The potential impact of such a breach on employees and customers highlights the importance of robust cybersecurity measures. Organizations in the professional services sector often manage sensitive client information and internal personnel records, making them targets for data exfiltration. To mitigate these risks, organizations typically focus on strengthening their defensive posture through regular security audits, employee training to recognize phishing, and implementing strict access controls to protect sensitive data environments.

It is also worth noting that the infrastructure used by the 8base group was disrupted in early 2025, which suggests that their operational capacity may have shifted since that time.