MODERNGRAB, S.A. Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized industrial and manufacturing firms across Europe, using double-extortion tactics that combine system encryption with the threat of publishing stolen data. In this environment, even specialised suppliers can find themselves listed on criminal leak sites, raising questions for clients, partners and employees about what may have been taken.

On 15 November 2023, the ransomware group known as 8base publicly listed MODERNGRAB, S.A., a Barcelona-based prepress company, claiming to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope is limited. The listing itself is a claim by the group; what is clear is that an organisation handling production-critical design and manufacturing data has been named in connection with a ransomware incident.

What happened

Public reporting states that MODERNGRAB, S.A. was listed by the 8base ransomware group on 15 November 2023. According to the available record, the group asserted that internal files had been exfiltrated in the course of a ransomware attack. No figure for the number of individuals affected has been disclosed, nor have precise details of the intrusion method, the volume of data, or the exact timeline of the compromise been made public beyond the listing date. The organisation has not, in the material provided, issued a detailed public technical account of the incident. As with many such listings, the claim originates from the threat actor’s leak site and should be treated as unverified until corroborated by the company or independent investigators.

Inside 8base

8base is a ransomware operation that emerged into wider public view in 2022 and 2023, following a model common among contemporary groups: encrypting victims’ systems while simultaneously stealing data and threatening to publish it if a ransom is not paid. The group maintains a Tor-based leak site where it names organisations and, in some cases, releases sample files or larger archives to increase pressure. Public reporting has associated 8base with attacks on a range of mid-market companies across multiple sectors and countries, often focusing on firms that may lack the extensive security resources of large enterprises. Its operators have been observed using relatively straightforward initial access methods and commodity tools, then moving to data theft and encryption. Claims made on the leak site about any specific victim, including MODERNGRAB, S.A., remain assertions by the group rather than independently Reported Facts unless otherwise confirmed.

MODERNGRAB, S.A. and its sector

MODERNGRAB, S.A. describes itself as a Spanish company based in Barcelona with more than four decades of specialisation in prepress solutions. It provides repro and design services, manufactures rotogravure cylinders and flexography plates, and states that it was the first Spanish firm to operate an automatic rotogravure manufacturing line using German electronic and diamond-percussion technology. Organisations in this niche sit at a critical point in the packaging and print supply chain: they convert client artwork and specifications into the physical tools used for high-volume printing. As such they typically hold detailed production files, client artwork, technical specifications, and commercial correspondence. A breach affecting a supplier of this type can therefore have downstream implications for brand owners, printers and other partners who rely on the integrity and confidentiality of those materials.

The information in question

The public record names the exposed material only as “internal files exfiltrated in ransomware attack.” No further breakdown of file types, data categories or volume has been disclosed in the available facts. Exact contents therefore remain unconfirmed. Companies engaged in prepress and cylinder or plate manufacturing commonly store design files, production parameters, client orders, invoices, employee records and internal correspondence. Whether any of those categories were among the files claimed by 8base has not been established in the material at hand. Until the organisation or competent authorities provide a clearer inventory, the precise nature of the data remains unknown.

Why it matters

For individuals whose details may have been present in internal systems—employees, contractors or client contacts—the principal risks are misuse of personal or contact information, targeted phishing, and potential fraud. For the company itself, the consequences can include operational disruption, contractual obligations to notify partners, reputational damage within a specialised industrial niche, and the cost of investigation and recovery. Because prepress data often embodies proprietary designs and manufacturing know-how, unauthorised access could also affect intellectual property belonging to MODERNGRAB’s customers. The absence of a confirmed headcount of affected people does not eliminate these risks; it simply means the scale cannot yet be quantified from public sources. Calm, practical monitoring of accounts and communications remains the most useful immediate response for anyone who has had a relationship with the firm.

Were you affected?

If you have worked with, supplied, or been employed by MODERNGRAB, S.A., treat the listing as a prompt to review your own exposure rather than as proof that your data was taken. Change passwords on any accounts that may have been linked to the company, enable multi-factor authentication where available, and watch for unexpected messages that reference the firm or request sensitive information. Keep an eye on financial and credit activity for unusual behaviour. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such checks are a practical first step while official notifications, if any, are awaited.

AICompiled with AI assistance from public sources and published under our editorial standards.