Intermountain Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Intermountain Listed by 8base Ransomware Group (reported July 29, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The breach surfaced through 8base’s public listing rather than through an announcement from Intermountain. The group claims internal files were exfiltrated, but the organization has not confirmed the intrusion, the volume of data involved, or whether any systems were encrypted.
Public records contain no information on ransom demands, payment status, or subsequent data publication. The exact date of the underlying attack also remains undisclosed.
Who is 8base?
8base is a ransomware group that emerged in 2022 and follows a double-extortion model. It typically encrypts victim systems and then threatens to publish stolen files on a dedicated leak site if payment is not received.
The group has listed organizations across multiple sectors on its site. Its listings constitute claims by the actors themselves; independent confirmation of the underlying incidents or the authenticity of posted data is not always available.
About Intermountain
Intermountain Centers for Human Development, Inc. operates as a nonprofit healthcare system in Arizona. It comprises several subsidiaries that deliver integrated behavioral health services and intensive welfare programs, including outpatient mental health care, foster care support, and community-based treatment.
Entities of this type routinely maintain records on individuals receiving counseling, psychiatric care, or child-welfare services. A compromise at such an organization therefore touches highly sensitive categories of personal information.
What was likely exposed
The only detail released is that internal files were allegedly exfiltrated. No inventory of file types, record counts, or specific data categories has been published.
Organizations providing behavioral health and welfare services commonly hold patient identifiers, clinical notes, treatment histories, insurance information, and contact details for clients and staff. The precise contents of the files referenced in the 8base listing remain unconfirmed.
Why it matters
Behavioral health records can reveal diagnoses, medication regimens, and personal circumstances that individuals often wish to keep private. Unauthorized disclosure of such material can lead to stigma, employment difficulties, or misuse in identity-related fraud.
For the organization, the incident adds to the administrative burden of incident response, regulatory notification, and potential legal exposure under health-privacy rules. No public statements have addressed these downstream effects.
If your data was in this claimed breach
Monitor statements from Intermountain for official guidance on next steps. Review bank and insurance accounts for unusual activity and consider placing fraud alerts with credit bureaus.
Change passwords for any accounts that may share credentials with Intermountain systems, and enable multi-factor authentication where available. Individuals can run a free exposure scan of their email address against known breach data to check for additional appearances.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
SMYRNAPEDIATRICS Listed by 8base Ransomware GroupER of Dallas Listed by 8base Ransomware GroupRedwood Lab Services Listed by 8base Ransomware GroupCST Medicina do Trabalho Listed by 8base Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Intermountain Listed by 8base Ransomware Group →
Publicly posted by 8base — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.