FEB31st Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations of every size by combining encryption with data theft and public leak-site listings, a pattern that has become a routine feature of the current threat landscape. Smaller specialist firms are frequently named alongside larger targets, often with limited public detail about the scale or contents of any compromise.

On 22 April 2024 the Italian eyewear company FEB31st was listed by the 8base ransomware group, which claimed that internal files had been exfiltrated. The number of people affected remains unknown and the precise contents of the material have not been disclosed. The listing itself is an unverified claim by the group; nevertheless, any confirmed exposure of internal business files can create lasting risks for customers, partners and the organisation.

What happened

Public reporting states that FEB31st was listed by the 8base ransomware group on 22 April 2024. The group asserted that internal files had been exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted—have been made public. The number of individuals whose information may have been involved is recorded as unknown. Beyond the group’s leak-site claim, independent confirmation of the full scope of the incident has not been released.

The group behind it: 8base

8base is a ransomware operation that became active in 2023 and is known for double-extortion tactics: data is stolen before systems are encrypted, and the group then threatens to publish the material on its leak site if a ransom is not paid. The group typically targets small and medium-sized enterprises across a range of sectors, using relatively standardised ransomware tooling and public naming of victims as leverage. Its leak-site listings are claims made by the operators themselves; they do not constitute independent verification that every named organisation was successfully compromised or that every asserted data set was in fact taken. In the case of FEB31st, the only public assertion is the group’s own listing and the statement that internal files were exfiltrated.

About FEB31st

FEB31st is an Italian company specialising in eco-friendly custom eyewear. Its public description presents the brand as a maker of artisanal, sustainable wooden glasses designed by Valerio Cometti, combining natural wood with colour and contemporary design. The business operates in the consumer-goods and fashion-accessories sector, producing and selling distinctive frames that appeal to customers seeking environmentally conscious products. Organisations of this type ordinarily maintain customer order records, payment and shipping details, design files, supplier contracts, and internal operational documents. A ransomware incident affecting such a firm can therefore touch both commercial intellectual property and personal data belonging to customers and staff, making the potential consequences more than purely technical.

What was likely exposed

The only data type named in public reporting is “internal files” said to have been exfiltrated in the ransomware attack. Exact file names, volumes, or categories have not been disclosed. Companies that design and sell custom eyewear typically hold customer contact and purchase information, shipping addresses, payment-related records, design drawings, supplier correspondence, employee data, and financial or operational documents. Whether any of these categories were among the files claimed by 8base remains unconfirmed. Readers should treat the precise contents as unknown until further verified information appears.

The real-world impact

If personal or financial details of customers or employees were among the internal files, those individuals face the ordinary risks associated with data exposure: phishing attempts that reference real orders or addresses, identity-fraud attempts, and unwanted contact. For the company itself, the incident can disrupt day-to-day operations, damage supplier and customer trust, and create regulatory notification obligations under European data-protection rules. Even when the full contents of a leak remain unverified, the mere public listing by a ransomware group can generate reputational pressure and require the organisation to investigate, contain and communicate about the event. Because the number of people affected is unknown, the practical scale of any individual harm cannot yet be quantified.

Were you affected?

If you have purchased eyewear from FEB31st, supplied goods or services to the company, or worked with it, treat the possibility of exposure seriously until more information is available. Monitor bank and card statements for unfamiliar charges, be alert to phishing messages that mention eyewear orders or Italian suppliers, and consider placing fraud alerts with credit-reference agencies if you believe sensitive personal data may have been involved. Change any passwords that were reused across accounts linked to the company. As a further practical step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such a scan provides an early indication of wider exposure even when the exact contents of a single incident remain unconfirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.