CST Medicina do Trabalho Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 6 September 2022, the Brazilian occupational-medicine firm CST Medicina do Trabalho appeared on the leak site operated by the ransomware group known as 8base. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected and the precise contents of those files remain undisclosed.

Because CST handles occupational-health and safety records for companies across Brazil, any confirmed exposure of internal material carries potential consequences for workers, employers and the firm itself. What follows summarises only what has been reported and places the incident in its proper context.

What happened

According to the available record, CST Medicina do Trabalho was listed by the 8base ransomware group on 6 September 2022. The listing asserts that internal files were taken during a ransomware attack. No further operational details—such as the initial access method, the duration of unauthorised presence, the volume of data removed, or any ransom demand—have been made public. The number of individuals whose information may be involved is listed as unknown. The group’s claim that it holds CST material has not been independently confirmed in the supplied facts.

Inside 8base

8base is a ransomware operation that became publicly visible in 2022. Like many contemporary groups, it has followed a double-extortion model: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if payment is not received. The group typically posts victim names, sometimes accompanied by sample files or descriptions of the stolen material, as pressure. Its earlier activity has included organisations in multiple countries and sectors. In the present case the only specific assertion tied to CST is the leak-site listing itself; no additional statements by 8base about this victim appear in the record.

Who is CST Medicina do Trabalho?

CST Medicina do Trabalho is an occupational-medicine provider based in Brazil with more than three decades of experience. It supplies services nationwide through a network of partners, covering occupational-safety programmes (including PPP, PPRA, PCMAT, PGR and LTCAT documentation), specialist consultations, and the full range of occupational clinical examinations—admission, periodic, return-to-work, change-of-function and dismissal exams—as well as complementary tests such as X-rays performed on site. Organisations of this type routinely process sensitive personal and health-related information belonging to employees of client companies. A breach involving such a provider therefore raises concerns that extend beyond the firm’s own staff to the wider workforce it serves.

What was likely exposed

The sole data description given in the public record is “internal files exfiltrated in ransomware attack.” Exact file names, categories or record counts have not been disclosed. In the ordinary course of business an occupational-medicine company holds material that can include:

• Employee identification and contact details
• Occupational health examination results and medical certificates
• Workplace risk assessments and safety programme documents
• Administrative and contractual records with client firms

Whether any or all of these categories were among the files claimed by 8base remains unconfirmed. No verified inventory has been released.

What's at stake

For individuals, the principal risks centre on the possible misuse of personal or health information—identity fraud, targeted phishing, or unwanted disclosure of medical findings that could affect employment or insurance. For client companies, exposure of safety documentation or employee lists could create regulatory, contractual or reputational complications. CST itself faces the operational and legal burdens that follow any ransomware incident: system recovery, notification obligations under Brazilian data-protection rules, and the need to restore confidence among the organisations that rely on its services. Because the scale of the incident is unknown, the actual breadth of these risks cannot yet be measured.

If your data was in this claimed breach

If you have ever undergone occupational examinations or safety assessments arranged through CST Medicina do Trabalho, treat the possibility of exposure seriously until more information appears. Practical first steps include monitoring financial and medical correspondence for unusual activity, enabling multi-factor authentication on email and other accounts, and being alert to phishing messages that reference workplace health checks. You may also wish to change passwords on any accounts that share credentials with systems used for occupational-health paperwork. Readers can run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Remain attentive to any official notices issued by CST or by Brazilian data-protection authorities as further facts become available.

AICompiled with AI assistance from public sources and published under our editorial standards.