Kerkstoel Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 23 September 2024, the Belgian precast-concrete firm Kerkstoel appeared on the leak site operated by the ransomware group known as 8base. Public reporting states that internal files were exfiltrated during a ransomware attack; the number of people affected remains unknown and further technical detail has not been released.

Because the listing itself is a claim by the attackers and has not been independently confirmed in open sources, the precise scope of the incident is still limited. What is known is enough to warrant attention from anyone who has worked with or for the company, given the nature of the data such organisations ordinarily hold.

Inside the incident

According to the available record, Kerkstoel was listed by 8base on 23 September 2024. The only concrete description of the compromise is that internal files were allegedly exfiltrated as part of a ransomware attack. No public statement has disclosed the initial access method, the duration of the intrusion, the volume of data taken, or whether encryption of systems also occurred. The number of individuals whose information may have been involved is listed as unknown. Beyond the leak-site claim and the brief characterisation of the data as internal files, no further verified timeline or forensic detail has been published.

Who is 8base?

8base is a ransomware operation that became active in the public eye in 2023. Like many contemporary groups, it practises double extortion: after gaining access to a network it steals data and then encrypts systems, threatening to publish the stolen material if a ransom is not paid. The group maintains a dark-web leak site on which it posts the names of claimed victims and, in some cases, sample files. Its targets have spanned manufacturing, professional services and other mid-sized enterprises across Europe and elsewhere. Public reporting has not established any special relationship between 8base and the construction-materials sector; the listing of Kerkstoel is simply one more claim on that site. As with all such listings, the group’s assertions should be treated as unverified until corroborated by the victim or by independent investigators.

Who is Kerkstoel?

Kerkstoel 2000+ is a Belgian manufacturer specialising in precast concrete floor slabs, insulated twin-wall panels and solid walls. It forms part of the larger Kerkstoel Group and supplies the construction industry with structural building components. Companies of this type typically maintain detailed engineering drawings, production schedules, customer contracts, supplier records, employee personnel files and financial documentation. A breach at such an organisation can therefore touch both commercial confidentiality and the personal data of staff and business partners. Because the firm sits inside a wider group structure, any compromise also raises questions about potential lateral movement to related entities, though no public evidence of such spread has been reported in this case.

What was likely exposed

The only data type named in the public record is “internal files” said to have been exfiltrated. No inventory of those files, no sample set, and no confirmation of specific categories such as employee records, customer lists or technical drawings has been released. Organisations in the precast-concrete sector commonly hold precisely those kinds of materials—personnel data, commercial contracts, design files and operational documents. Whether any of them were among the files taken remains unconfirmed. Readers should therefore treat every concrete claim about the contents of the stolen material as speculative until official disclosure occurs.

What's at stake

For individuals, the principal risks are identity-related fraud or targeted social-engineering if personal details of employees or contractors were included. For the company itself, the exposure of internal files can mean loss of competitive advantage, contractual disputes with clients, and regulatory scrutiny under European data-protection rules. Even when the exact contents stay unknown, the mere fact of a ransomware-linked exfiltration creates lasting uncertainty: stolen data can reappear months later on criminal markets, and the organisation must still investigate, notify regulators where required, and restore operational confidence. None of these consequences has been quantified in public reporting for this incident; they remain the ordinary, concrete stakes of any such event.

Were you affected?

If you are a current or former employee, contractor or business partner of Kerkstoel or the wider Kerkstoel Group, treat the possibility of exposure as real until clearer information emerges. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever available, and be cautious of unexpected messages that reference the company or its projects. You can also run a free exposure scan of your email address against known breach data sets to see whether your details have already appeared in other incidents. Official updates, if any, will come from the company or from competent authorities; until then, the public record remains limited to the 8base listing and the statement that internal files were taken.

AICompiled with AI assistance from public sources and published under our editorial standards.