Tarnaise des Panneaux SAS targeted by 8base ransomware group

• Ransomware group: 8base
• Country: France
• Sector: Manufacturing
• Announcement date: January 3, 2025

8base claims data breach at Tarnaise des Panneaux SAS

The ransomware group known as 8base has listed the French manufacturing company Tarnaise des Panneaux SAS on its leak site. In an announcement made on January 3, 2025, the threat actor claimed to have successfully targeted the organization and obtained its internal data. This development marks a significant escalation in the pressure applied to the company through public disclosure threats.

The incident is characterized by the group's use of double-extortion tactics. In such scenarios, ransomware actors do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information. By threatening to release this stolen data on a public leak site, the attackers aim to exert maximum psychological and reputational pressure on the organization to meet their demands. This method increases the stakes for the victim, as the threat shifts from a simple operational outage to a long-term data privacy and intellectual property crisis.

Details of the claimed data theft

According to the announcement published by 8base, the group has accessed a variety of internal documents belonging to the company. The group alleges that they have successfully compromised sensitive files that are critical to the organization's daily operations and administrative functions. While the specific volume of data and the exact number of files involved have not been disclosed by the group, the scope of the categories mentioned is broad.

The data types claimed to be compromised include:

• Receipts
• Technical documents
• Reports
• Accounting documents
• Schemes
• Plans
• Internal documents

The exposure of such diverse documentation—ranging from financial records to technical schematics—presents a multifaceted risk to the organization's integrity and competitive standing.

About Tarnaise des Panneaux SAS

Tarnaise des Panneaux SAS is a manufacturing company based in France. The organization specializes in the production of boards made from high-density wood fibers. These products are manufactured without the use of synthetic binders and are commonly recognized in the industry as Hardboard or Isorel®.

Analysis and potential implications

The 8base group is a known double-extortion threat actor that has been active since 2022. Reports suggest that the group utilizes an encryptor derived from the Phobos ransomware family. Despite a reported operation targeting the group's infrastructure in early 2025, which may have impacted their operational capacity, the group appears to have continued its malicious activities.

The potential leak of the claimed data carries several severe consequences. From a regulatory perspective, the exposure of sensitive information could include the personal data of employees and customers. Such a breach could trigger significant legal consequences under the General Data Protection Regulation (GDPR). Furthermore, the theft of technical documents, plans, and schemes poses a direct threat to the company's intellectual property. The disclosure of these trade secrets could result in a significant competitive disadvantage in the manufacturing sector.

Beyond the immediate impact, stolen data of this nature is often repurposed by threat actors for secondary attacks. This includes identity theft or the orchestration of highly targeted phishing campaigns against the company's partners, clients, or staff members. For organizations in the manufacturing sector, protecting technical blueprints and accounting records is vital to maintaining market position and operational security.

To mitigate such risks, organizations typically focus on robust defense-in-depth strategies. This includes implementing strict access controls to limit the movement of attackers within a network, maintaining comprehensive logging to detect unauthorized data exfiltration, and ensuring that sensitive technical and financial data is encrypted both at rest and in transit. Regular security audits and employee awareness training regarding phishing are also fundamental components of a resilient cybersecurity posture.