ASCOM S.p.A. Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 7 January 2025, the ransomware group known as 8base listed ASCOM S.p.A. on its leak site, claiming to have carried out a ransomware attack that involved the exfiltration of internal files. The number of people whose information may have been involved remains unknown, and public detail on the precise scope is limited. For employees, partners, suppliers or customers who deal with the Italian firm, the practical concern is straightforward: internal company material has been claimed as taken, and that material can sometimes include personal or commercial details that create lasting risk.

Because the listing is an unverified claim by the group itself, confirmation of what was actually removed, how far the intrusion went, or whether any data has been released has not been independently established in the available record. Still, any organisation that handles operational, commercial or personnel records must treat such a claim seriously until more is known.

Breaking down the breach

According to the public listing, ASCOM S.p.A. was named by 8base on 7 January 2025. The only concrete description provided is that internal files were allegedly exfiltrated in a ransomware attack. No figure for the volume of data, no list of specific file categories beyond “internal files,” no timeline of when the intrusion began or ended, and no statement of whether encryption of systems also occurred have been disclosed in the available facts. The number of individuals potentially affected is recorded as unknown.

Ransomware incidents of this type typically involve an initial foothold, lateral movement, data theft, and then a demand for payment under threat of publication. In this case the public record stops at the group’s claim of exfiltration; further technical or forensic detail has not been released.

Who is 8base?

8base is a ransomware operation that has been active since at least 2022–2023 and is known for a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. The group has historically targeted mid-sized organisations across manufacturing, professional services and other sectors, often using relatively straightforward initial access methods such as compromised credentials or unpatched remote services. Once inside, operators commonly deploy tools to map the network, extract files, and then leave a ransom note.

Like many such groups, 8base maintains a public blog or leak site where it names victims and, in some cases, releases samples or full archives of stolen material. Listings on that site constitute claims by the group; they are not independent confirmation that every asserted detail is accurate. No specific statements by 8base about the contents of ASCOM S.p.A.’s files beyond the general assertion of internal-file exfiltration appear in the facts provided.

About ASCOM S.p.A.

ASCOM S.p.A., also referred to as Ascom Italy, designs and manufactures lifting equipment for the marine and industrial sectors. Its product range includes boat lifts, cranes and customised solutions for shipyards and industrial facilities. The company emphasises high-quality, customer-adapted engineering. Organisations of this kind routinely hold engineering drawings, production schedules, supplier contracts, customer project data, employee records and financial documentation. A breach claim against such a firm therefore raises questions about both operational continuity and the confidentiality of commercial and personal information.

Because ASCOM operates in specialised industrial niches, any exposure of internal files can affect not only its own workforce but also shipyards, industrial clients and supply-chain partners who rely on the integrity of shared technical or commercial data.

The information in question

The only data type named in the available record is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether employee personal data, customer contracts, engineering plans, financial records or authentication credentials were among those files—has been disclosed. Public detail is therefore limited.

Companies that manufacture specialised lifting equipment typically maintain personnel files, payroll information, supplier and customer contact details, project specifications, quality-control records and internal correspondence. Whether any of those categories were actually taken remains unconfirmed. Until more precise information is released by the company or by independent investigators, the exact contents of the claimed exfiltration cannot be stated as fact.

What's at stake

For individuals whose details may appear in internal files, the concrete risks include possible misuse of contact information, identity-related fraud if personal identifiers were present, or targeted phishing that leverages knowledge of the company’s operations. For the organisation itself, the stakes include potential disruption of manufacturing and delivery schedules, loss of competitive technical information, regulatory notification duties if personal data prove to be involved, and reputational pressure from customers and partners who expect secure handling of shared projects.

Because the scale remains unknown, the practical impact could range from limited internal inconvenience to broader commercial exposure. In either case, the absence of confirmed numbers does not remove the need for vigilance.

Were you affected?

If you are an employee, former employee, supplier or customer of ASCOM S.p.A., treat the claim as a prompt to take basic protective steps while waiting for any official notification. Concrete actions include:

• Monitor bank and credit accounts for unexpected activity and consider a temporary fraud alert if you have shared personal identifiers with the company.
• Change passwords for any accounts that used the same credentials as work-related systems, and enable multi-factor authentication wherever available.
• Be alert to phishing messages that reference ASCOM projects, invoices or personnel matters; verify unexpected requests through a separate channel.
• Retain any official communication from the company about the incident so you can follow its guidance on credit monitoring or identity-protection offers if they are provided.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan does not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant the same precautions.

AICompiled with AI assistance from public sources and published under our editorial standards.