International Trade Brokers and Forwarders Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

International Trade Brokers and Forwarders, a U.S.-focused customs brokerage and logistics firm, was listed by the 8base ransomware group on or around January 12, 2024. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical details have not been disclosed.

The listing itself is a claim by the group. For an organization that handles customs clearance, cargo documentation and client logistics data, any confirmed compromise of internal files carries practical consequences for the firm and for the companies and individuals whose records it may hold.

What happened

On January 12, 2024, International Trade Brokers and Forwarders appeared on the leak site associated with the 8base ransomware group. Available information indicates that the incident involved a ransomware attack in which internal files were taken. No public confirmation has been issued by the company detailing the method of intrusion, the precise date of compromise, the volume of data removed, or whether systems were encrypted. The number of individuals or client organizations potentially affected is listed as unknown. Beyond the group’s claim of exfiltration of internal files, no additional specifics about the attack timeline or scope have been released in open sources.

Inside 8base

8base is a ransomware operation that has been active in the public domain since at least mid-2022. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group maintains a dedicated leak site on which it posts victim names, sample files and, in some cases, larger archives. Public reporting has linked 8base to attacks across multiple sectors, including professional services, manufacturing and logistics. Its operators have been observed using common initial-access techniques such as phishing, exploitation of exposed remote-access services and purchase of credentials from initial-access brokers. Once inside a network, the group is known to move laterally, disable backups where possible, and exfiltrate data before deploying encryption. Claims posted on its leak site are assertions by the attackers and are not independently verified unless corroborated by the victim or forensic investigators.

Who is International Trade Brokers and Forwarders?

International Trade Brokers and Forwarders, also referred to as ITBF, describes itself as a company with more than twenty years of experience in international trade services. It operates as a licensed customs broker certified under the Customs Trade Partnership Against Terrorism (C-TPAT) program of U.S. Customs and Border Protection. The firm provides customs clearance for merchandise arriving at U.S. ports of entry, including Puerto Rico and Hawaii, and supports clients with logistics and transportation coordination. Organizations of this type routinely handle commercial invoices, bills of lading, packing lists, importer and exporter identification numbers, contact details for shippers and consignees, and related compliance documentation. Because they sit at the intersection of private commerce and government regulatory processes, the data they process is both commercially sensitive and subject to various record-keeping and privacy requirements.

What was likely exposed

The only data category named in connection with the incident is “internal files” said to have been exfiltrated. No inventory of specific document types, file counts or data fields has been published. Firms engaged in customs brokerage and freight forwarding typically maintain records that can include client business names and addresses, tax and importer identification numbers, shipment details, correspondence with customs authorities, financial transaction records related to duties and fees, and employee or contractor information. Whether any of those categories were among the files taken in this case has not been confirmed. Public detail on the exact contents remains limited; statements that particular personal or commercial data sets may have been exposed would be speculative at this stage.

Why it matters

For clients of a customs broker, exposure of internal files can create several concrete risks. Commercial invoices and shipping records may reveal pricing, supplier relationships and inventory movements that competitors could exploit. Identification numbers and contact data can be used in targeted phishing or social-engineering attempts that impersonate legitimate logistics partners. If employee or contractor records were included, those individuals face the usual downstream risks of credential stuffing, identity fraud or unwanted contact. For the organization itself, the incident can disrupt operations, trigger contractual notification obligations to clients, and invite scrutiny from customs authorities or partners who rely on the firm’s C-TPAT status. Even when encryption is not confirmed, the mere claim of data theft can erode trust and generate legal and reputational costs that persist long after systems are restored.

Were you affected?

If you have done business with International Trade Brokers and Forwarders or believe your personal or company information may have been held by the firm, monitor financial and shipping accounts for unexpected activity and treat unsolicited requests for payment or document verification with caution. Change passwords on any accounts that may have shared credentials with systems used by the company, and enable multi-factor authentication where available. Because the full scope of the incident remains unconfirmed, there is no public list of affected individuals. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information has already appeared in other incidents; such a check is a practical first step while waiting for any official notifications that may follow.

AICompiled with AI assistance from public sources and published under our editorial standards.